Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2024-38551: Linux kernel MediaTek audio driver may crash without codec
CVE-2024-38551 · published 2 years ago
Summary
The MediaTek sound card drivers in the Linux kernel can run into a problem when they look for a sound codec that isn’t present on the hardware. Without a real codec, the driver may try to compare a missing value and cause the system to stop responding. Updating the kernel to the latest version fixes the issue by assigning a placeholder codec, preventing the crash.
What to do
- Update debian linux to version 6.8.12-1.
- Update linux kernel to version 6.9.3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:13 | debian | linux |
< 6.8.12-1 Fix: upgrade to 6.8.12-1
|
| Debian:14 | debian | linux |
< 6.8.12-1 Fix: upgrade to 6.8.12-1
|
| – | linux | linux_kernel |
>= 6.3, < 6.6.33 >= 6.7, < 6.8.12 >= 6.9, < 6.9.3 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Linux | linux | kernel |
>= 6.9.0, < 6.9.3 Fix: upgrade to 6.9.3
|
Original advisory text
ASoC: mediatek: Assign dummy when codec not specified for a DAI link
In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: Assign dummy when codec not specified for a DAI link MediaTek sound card drivers are checking whether a DAI link is present and used on a board to assign the correct parameters and this is done by checking the codec DAI names at probe time. If no real codec is present, assign the dummy codec to the DAI link to avoid NULL pointer during string comparison.
References
- https://security-tracker.debian.org/tracker/CVE-2024-38551 Vendor Advisory
- https://git.kernel.org/stable/c/87b8dca6e06f9b1681bc52bf7bfa85c663a11158 URL
- https://git.kernel.org/stable/c/0c052b1c11d8119f3048b1f7b3c39a90500cacf9 URL
- https://git.kernel.org/stable/c/5f39231888c63f0a7708abc86b51b847476379d8 URL
- https://git.kernel.org/stable/c/cbbcabc7f0979f6542372cf88d7a9da7143a4226 URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/38xxx/CVE-2024-38551... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-38551 Vendor Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git Product
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-476NULL Pointer Dereference
Timeline
Published19 Jun 2024
Updated4 Nov 2026
First seen1 Sep 2026
Track software like this
Free during beta