{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 6.2,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-26799",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-04T15:07:57.653434Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-01T14:54:06.205Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:14:13.565Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/99adc8b4d2f38bf0d06483ec845bc48f60c3f8cf"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d5a7726e6ea62d447b79ab5baeb537ea6bdb225b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1382d8b55129875b2e07c4d2a7ebc790183769ee"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/soc/qcom/lpass-cdc-dma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3301f5513e668d47514f32b0fea39e85b1152010",
              "status": "affected",
              "version": "b81af585ea54ee9f749391e594ee9cbd44061eae",
              "versionType": "git"
            },
            {
              "lessThan": "99adc8b4d2f38bf0d06483ec845bc48f60c3f8cf",
              "status": "affected",
              "version": "b81af585ea54ee9f749391e594ee9cbd44061eae",
              "versionType": "git"
            },
            {
              "lessThan": "d5a7726e6ea62d447b79ab5baeb537ea6bdb225b",
              "status": "affected",
              "version": "b81af585ea54ee9f749391e594ee9cbd44061eae",
              "versionType": "git"
            },
            {
              "lessThan": "1382d8b55129875b2e07c4d2a7ebc790183769ee",
              "status": "affected",
              "version": "b81af585ea54ee9f749391e594ee9cbd44061eae",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/soc/qcom/lpass-cdc-dma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.191",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.21",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.191",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.21",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.9",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: qcom: Fix uninitialized pointer dmactl\n\nIn the case where __lpass_get_dmactl_handle is called and the driver\nid dai_id is invalid the pointer dmactl is not being assigned a value,\nand dmactl contains a garbage value since it has not been initialized\nand so the null check may not work. Fix this to initialize dmactl to\nNULL. One could argue that modern compilers will set this to zero, but\nit is useful to keep this initialized as per the same way in functions\n__lpass_platform_codec_intf_init and lpass_cdc_dma_daiops_hw_params.\n\nCleans up clang scan build warning:\nsound/soc/qcom/lpass-cdc-dma.c:275:7: warning: Branch condition\nevaluates to a garbage value [core.uninitialized.Branch]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The only way to invoke `lpass_cdc_dma_daiops_trigger()` is an `SNDRV_PCM_IOCTL_DROP`/`PAUSE` ioctl on a local `/dev/snd/pcmC*D*` node, routed through `soc_pcm_trigger()` \u2192 `snd_soc_pcm_dai_trigger()`. No packet, adjacent-network, or physical path reaches this DAI operation.\nAC:H - The uninitialized `dmactl` is only consumed when `__lpass_get_dmactl_handle()` falls to its `default:` arm, which requires `cpu_dai-\u003edriver-\u003eid` to lie outside `LPASS_CDC_DMA_RX0\u2026VA_TX8`; that id is a compile-time constant in the DAI table and the sole in-tree consumer (`lpass-sc7280.c`: ids 6, 19, 25) is fully covered. The attacker cannot influence which DAI table the kernel was built with, which is CVSS\u0027s \"conditions beyond the attacker\u0027s control.\"\nPR:L - Reaching the trigger op needs only an open PCM substream on a `root:audio` 0660 device node \u2014 no `capable()`, `CAP_SYS_ADMIN`, or any other check exists along `snd_pcm_ioctl` \u2192 `soc_pcm_trigger` \u2192 the DAI callback. A local unprivileged account with routine audio access (default for desktop and Chromebook sessions on this SoC) suffices.\nUI:N - The attacker opens the PCM device and issues the DROP/PAUSE ioctls entirely from their own process. No victim needs to play audio, mount anything, or take any action.\nS:U - The garbage pointer is dereferenced by kernel code operating on the kernel\u0027s own LPASS regmap, and all consequences stay within the kernel\u0027s security authority. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - When the branch is taken, `dmactl` holds residual kernel-stack data that an attacker can prime via a preceding syscall at the same stack depth, and `dmactl-\u003ecodec_enable` is then loaded as a `struct reg_field *` \u2014 an attacker-influenced read of arbitrary kernel memory feeding subsequent regmap state. Per the round-up rule this uncontrolled-pointer read is scored High rather than as a bounded leak.\nI:H - `regmap_fields_write(dmactl-\u003ecodec_enable, id, LPAIF_DMACTL_ENABLE_OFF)` performs a write through a field descriptor obtained from the wild pointer, with `id` also left uninitialized as the field index, yielding writes to attacker-influenced register/memory locations. That is a memory-corruption primitive usable toward control-flow hijack, not a bounded modification.\nA:H - Dereferencing an uninitialized stack pointer that survives the `if (!dmactl)` guard produces an immediate oops in `regmap_fields_write()`, and a bad regmap field index can additionally program the LPASS DMA control block into an invalid state. Any such kernel oops or wedged audio DMA engine is a full availability loss."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T12:17:51.599Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3301f5513e668d47514f32b0fea39e85b1152010"
        },
        {
          "url": "https://git.kernel.org/stable/c/99adc8b4d2f38bf0d06483ec845bc48f60c3f8cf"
        },
        {
          "url": "https://git.kernel.org/stable/c/d5a7726e6ea62d447b79ab5baeb537ea6bdb225b"
        },
        {
          "url": "https://git.kernel.org/stable/c/1382d8b55129875b2e07c4d2a7ebc790183769ee"
        }
      ],
      "title": "ASoC: qcom: Fix uninitialized pointer dmactl",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26799",
    "datePublished": "2024-04-04T08:20:27.888Z",
    "dateReserved": "2024-02-19T14:20:24.179Z",
    "dateUpdated": "2026-10-30T12:17:51.599Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/99adc8b4d2f38bf0d06483ec845bc48f60c3f8cf\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/d5a7726e6ea62d447b79ab5baeb537ea6bdb225b\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/1382d8b55129875b2e07c4d2a7ebc790183769ee\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:14:13.565Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.2, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26799\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-04-04T15:07:57.653434Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"description\": \"CWE-noinfo Not enough information\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:21.943Z\"}}], \"cna\": {\"title\": \"ASoC: qcom: Fix uninitialized pointer dmactl\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The only way to invoke `lpass_cdc_dma_daiops_trigger()` is an `SNDRV_PCM_IOCTL_DROP`/`PAUSE` ioctl on a local `/dev/snd/pcmC*D*` node, routed through `soc_pcm_trigger()` \\u2192 `snd_soc_pcm_dai_trigger()`. No packet, adjacent-network, or physical path reaches this DAI operation.\\nAC:H - The uninitialized `dmactl` is only consumed when `__lpass_get_dmactl_handle()` falls to its `default:` arm, which requires `cpu_dai-\u003edriver-\u003eid` to lie outside `LPASS_CDC_DMA_RX0\\u2026VA_TX8`; that id is a compile-time constant in the DAI table and the sole in-tree consumer (`lpass-sc7280.c`: ids 6, 19, 25) is fully covered. The attacker cannot influence which DAI table the kernel was built with, which is CVSS\u0027s \\\"conditions beyond the attacker\u0027s control.\\\"\\nPR:L - Reaching the trigger op needs only an open PCM substream on a `root:audio` 0660 device node \\u2014 no `capable()`, `CAP_SYS_ADMIN`, or any other check exists along `snd_pcm_ioctl` \\u2192 `soc_pcm_trigger` \\u2192 the DAI callback. A local unprivileged account with routine audio access (default for desktop and Chromebook sessions on this SoC) suffices.\\nUI:N - The attacker opens the PCM device and issues the DROP/PAUSE ioctls entirely from their own process. No victim needs to play audio, mount anything, or take any action.\\nS:U - The garbage pointer is dereferenced by kernel code operating on the kernel\u0027s own LPASS regmap, and all consequences stay within the kernel\u0027s security authority. No hypervisor, IOMMU, or sandbox boundary is crossed.\\nC:H - When the branch is taken, `dmactl` holds residual kernel-stack data that an attacker can prime via a preceding syscall at the same stack depth, and `dmactl-\u003ecodec_enable` is then loaded as a `struct reg_field *` \\u2014 an attacker-influenced read of arbitrary kernel memory feeding subsequent regmap state. Per the round-up rule this uncontrolled-pointer read is scored High rather than as a bounded leak.\\nI:H - `regmap_fields_write(dmactl-\u003ecodec_enable, id, LPAIF_DMACTL_ENABLE_OFF)` performs a write through a field descriptor obtained from the wild pointer, with `id` also left uninitialized as the field index, yielding writes to attacker-influenced register/memory locations. That is a memory-corruption primitive usable toward control-flow hijack, not a bounded modification.\\nA:H - Dereferencing an uninitialized stack pointer that survives the `if (!dmactl)` guard produces an immediate oops in `regmap_fields_write()`, and a bad regmap field index can additionally program the LPASS DMA control block into an invalid state. Any such kernel oops or wedged audio DMA engine is a full availability loss.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"b81af585ea54ee9f749391e594ee9cbd44061eae\", \"lessThan\": \"3301f5513e668d47514f32b0fea39e85b1152010\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b81af585ea54ee9f749391e594ee9cbd44061eae\", \"lessThan\": \"99adc8b4d2f38bf0d06483ec845bc48f60c3f8cf\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b81af585ea54ee9f749391e594ee9cbd44061eae\", \"lessThan\": \"d5a7726e6ea62d447b79ab5baeb537ea6bdb225b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b81af585ea54ee9f749391e594ee9cbd44061eae\", \"lessThan\": \"1382d8b55129875b2e07c4d2a7ebc790183769ee\", \"versionType\": \"git\"}], \"programFiles\": [\"sound/soc/qcom/lpass-cdc-dma.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.18\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.18\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.191\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.21\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.9\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"sound/soc/qcom/lpass-cdc-dma.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/3301f5513e668d47514f32b0fea39e85b1152010\"}, {\"url\": \"https://git.kernel.org/stable/c/99adc8b4d2f38bf0d06483ec845bc48f60c3f8cf\"}, {\"url\": \"https://git.kernel.org/stable/c/d5a7726e6ea62d447b79ab5baeb537ea6bdb225b\"}, {\"url\": \"https://git.kernel.org/stable/c/1382d8b55129875b2e07c4d2a7ebc790183769ee\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nASoC: qcom: Fix uninitialized pointer dmactl\\n\\nIn the case where __lpass_get_dmactl_handle is called and the driver\\nid dai_id is invalid the pointer dmactl is not being assigned a value,\\nand dmactl contains a garbage value since it has not been initialized\\nand so the null check may not work. Fix this to initialize dmactl to\\nNULL. One could argue that modern compilers will set this to zero, but\\nit is useful to keep this initialized as per the same way in functions\\n__lpass_platform_codec_intf_init and lpass_cdc_dma_daiops_hw_params.\\n\\nCleans up clang scan build warning:\\nsound/soc/qcom/lpass-cdc-dma.c:275:7: warning: Branch condition\\nevaluates to a garbage value [core.uninitialized.Branch]\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.191\", \"versionStartIncluding\": \"5.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.21\", \"versionStartIncluding\": \"5.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.9\", \"versionStartIncluding\": \"5.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8\", \"versionStartIncluding\": \"5.18\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-10-30T12:17:51.599Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-26799\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-30T12:17:51.599Z\", \"dateReserved\": \"2024-02-19T14:20:24.179Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-04-04T08:20:27.888Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}