Loading story…
CVE-2024-58012 affects the Linux kernel's ASoC Sound Open Firmware (SOF) Intel HDA DAI component. Audio topologies using aggregated amplifiers can fail to create all required DAI widgets, leaving a CPU DAI linked to a NULL widget; subsequent parameter processing can trigger a NULL-pointer dereference and crash the kernel or affected audio path. The upstream fix verifies that the CPU DAI's widget exists before using it.
The flaw is fixed upstream in Linux kernel versions 6.12.14, 6.13.3, and 6.14-rc1; maintainers recommend updating to a current stable kernel rather than cherry-picking the patch. Red Hat shipped fixes for RHEL 10 in RHSA-2025:20095 and RHEL 9 in RHSA-2025:20518; the RHEL 9 real-time kernel fix remains deferred, while RHEL 8 kernel variants are outside the affected support scope. Red Hat rates the local, high-privilege denial-of-service issue 4.4 CVSS v3.1, compared with 5.5 ratings from NVD and CVE.org.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2025:20095 for Red Hat Enterprise Linux 10 and RHSA-2025:20518 for Red Hat Enterprise Linux 9, addressing CVE-2024-58012. RHEL 9 kernel-rt remained fix-deferred, while RHEL 8 kernel variants were outside support scope.
The issue was fixed in Linux kernel versions 6.12.14, 6.13.3, and 6.14-rc1 by validating that the DAI widget exists before it is used. The Linux kernel CVE team recommended updating to a current stable kernel release rather than cherry-picking individual commits.
The Linux kernel CVE team assigned CVE-2024-58012 for a NULL-pointer dereference in the ASoC SOF Intel HDA DAI code. Aggregated-amplifier audio topologies can leave a CPU DAI without a valid widget during parameter handling.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourceredhat.com
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2024-58077** affects the Linux kernel ALSA System-on-Chip (ASoC) PCM implementation in `sound/soc/soc-pcm.c`. The `.prepare` callback incorrectly used the shared `soc_pcm_ret()` error handler, which broadly suppresses `-EINVAL` errors. That suppression was intended to stop user-controlled invalid audio parameters from generating excessive syslog output and consuming disk space, but was inappropriate in the callback and could enable a local denial of service through uncontrolled resource consumption. Upstream Linux fixes remove `soc_pcm_ret()` from the `.prepare` path and are available in kernel versions 6.1.129, 6.6.78, 6.12.14, 6.13.3, and 6.14-rc1 and later. Red Hat rated the issue **4.4/10** due to required local, high-privilege access and availability impact, while NVD assigned **5.5/10**; fixes were released for RHEL 9 and RHEL 10 through RHSA-2025:20518 and RHSA-2025:20095, respectively, while the RHEL 9 `kernel-rt` fix remained deferred.
Aug 26, 2026
**CVE-2024-26717** is a local denial-of-service flaw in the Linux kernel's Open Firmware (OF) I2C HID driver at `drivers/hid/i2c-hid/i2c-hid-of.c`. Introduced in kernel 5.12 when I2C HID support was split into ACPI and OF implementations, the OF driver can leave a client pointer uninitialized; a failed device power-up can then trigger a NULL-pointer dereference and crash or restart the kernel. The issue is fixed in upstream kernels 5.15.149, 6.1.79, 6.6.18, 6.7.6, and 6.8 and later. Red Hat rated the flaw CVSS 4.4 (low) and released corrected kernel packages for affected RHEL 8, RHEL 9, and RHEL 9.4 Extended Update Support systems; its referenced advisory listed RHEL 9 `kernel-rt` as affected without a corresponding erratum. Organizations should deploy current vendor kernel updates rather than cherry-picking the individual patch.
Aug 26, 2026
**CVE-2024-26939** is a use-after-free flaw in the Linux kernel's Intel i915 DRM graphics driver, in `drivers/gpu/drm/i915/i915_vma.c`. A race between i915 VMA destruction and asynchronous retirement can free a VMA while retirement logic still accesses it, allowing a local low-privileged attacker to crash the affected system. The vulnerability was introduced in Linux 5.19 and can produce debug-object warnings when a GPU GT is parked. The issue is fixed upstream in Linux kernel versions 6.1.88, 6.6.29, 6.8.3, and 6.9-rc2 and later stable releases. Red Hat has issued fixes for RHEL 8, RHEL 8 kernel-rt, RHEL 9, and RHEL 9.4 Extended Update Support; RHEL 9 kernel-rt is marked will not fix, while RHEL 6 and 7 variants are outside support scope. Red Hat rates the flaw Moderate at CVSS 5.5, compared with scores of 7.0 from NVD and 7.8 from CVE.org.
Aug 26, 2026