Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2024-41037: Linux kernel may crash during suspend on Intel audio
CVE-2024-41037 · published 2 years ago
Summary
The Linux kernel version used in Debian and other distributions can encounter a crash when the computer goes into suspend mode while audio is playing on certain Intel sound hardware. The problem occurs because a needed audio link is cleared too early, causing the system to try to use a missing object. Install the latest kernel updates that include the fix to prevent this issue.
What to do
- Update debian linux to version 6.9.10-1.
- Update linux kernel to version 6.9.10.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:13 | debian | linux |
< 6.9.10-1 Fix: upgrade to 6.9.10-1
|
| Debian:14 | debian | linux |
< 6.9.10-1 Fix: upgrade to 6.9.10-1
|
| – | linux | linux_kernel |
>= 6.4, < 6.6.41 >= 6.7, < 6.9.10 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Linux | linux | kernel |
>= 6.7.0, < 6.9.10 Fix: upgrade to 6.9.10
|
Original advisory text
ASoC: SOF: Intel: hda: fix null deref on system suspend entry
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: hda: fix null deref on system suspend entry When system enters suspend with an active stream, SOF core calls hw_params_upon_resume(). On Intel platforms with HDA DMA used to manage the link DMA, this leads to call chain of hda_dsp_set_hw_params_upon_resume() -> hda_dsp_dais_suspend() -> hda_dai_suspend() -> hda_ipc4_post_trigger() A bug is hit in hda_dai_suspend() as hda_link_dma_cleanup() is run first, which clears hext_stream->link_substream, and then hda_ipc4_post_trigger() is called with a NULL snd_pcm_substream pointer.
References
- https://security-tracker.debian.org/tracker/CVE-2024-41037 Vendor Advisory
- https://git.kernel.org/stable/c/993af0f2d9f24e3c18a445ae22b34190d1fcad61 URL
- https://git.kernel.org/stable/c/8246bbf818ed7b8d5afc92b951e6d562b45c2450 URL
- https://git.kernel.org/stable/c/9065693dcc13f287b9e4991f43aee70cf5538fdd URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41037... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-41037 Vendor Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git Product
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-476NULL Pointer Dereference
Timeline
Published29 Jul 2024
Updated3 Nov 2026
First seen1 Sep 2026
Track software like this
Free during beta