Debian: CVE-2024-56532: linux -- security update

Debian: CVE-2024-56532: linux -- security update

Severity

4

CVSS

(AV:L/AC:M/Au:N/C:P/I:P/A:P)

Published

12/27/2024

Created

01/14/2025

Added

01/13/2025

Modified

01/13/2025

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: us122l: Use snd_card_free_when_closed() at disconnection The USB disconnect callback is supposed to be short and not too-long waiting.OTOH, the current code uses snd_card_free() at disconnection, but this waits for the close of all used fds, hence it can take long.It eventually blocks the upper layer USB ioctls, which may trigger a soft lockup. An easy workaround is to replace snd_card_free() with snd_card_free_when_closed().This variant returns immediately while the release of resources is done asynchronously by the card device release at the last close. The loop of us122l->mmap_count check is dropped as well.The check is useless for the asynchronous operation with *_when_closed().

Solution(s)

• debian-upgrade-linux

References

• https://attackerkb.com/topics/cve-2024-56532
• CVE - 2024-56532