Loading story…
CVE-2024-58077 affects the Linux kernel ALSA System-on-Chip (ASoC) PCM implementation in sound/soc/soc-pcm.c. The .prepare callback incorrectly used the shared soc_pcm_ret() error handler, which broadly suppresses -EINVAL errors. That suppression was intended to stop user-controlled invalid audio parameters from generating excessive syslog output and consuming disk space, but was inappropriate in the callback and could enable a local denial of service through uncontrolled resource consumption.
Upstream Linux fixes remove soc_pcm_ret() from the .prepare path and are available in kernel versions 6.1.129, 6.6.78, 6.12.14, 6.13.3, and 6.14-rc1 and later. Red Hat rated the issue 4.4/10 due to required local, high-privilege access and availability impact, while NVD assigned 5.5/10; fixes were released for RHEL 9 and RHEL 10 through RHSA-2025:20518 and RHSA-2025:20095, respectively, while the RHEL 9 kernel-rt fix remained deferred.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2025:20095 for RHEL 10 and RHSA-2025:20518 for RHEL 9, providing kernel fixes for CVE-2024-58077. RHEL 9 kernel-rt remained fix-deferred.
The Linux kernel CVE team announced CVE-2024-58077 in ALSA ASoC PCM code, where the .prepare callback's use of soc_pcm_ret() could improperly suppress -EINVAL errors. The upstream remediation removes soc_pcm_ret() from that callback; fixes were identified in kernel versions 6.1.129, 6.6.78, 6.12.14, 6.13.3, and 6.14-rc1.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourceredhat.com
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2024-58012** affects the Linux kernel's ASoC Sound Open Firmware (SOF) Intel HDA DAI component. Audio topologies using aggregated amplifiers can fail to create all required DAI widgets, leaving a CPU DAI linked to a NULL widget; subsequent parameter processing can trigger a NULL-pointer dereference and crash the kernel or affected audio path. The upstream fix verifies that the CPU DAI's widget exists before using it. The flaw is fixed upstream in Linux kernel versions **6.12.14**, **6.13.3**, and **6.14-rc1**; maintainers recommend updating to a current stable kernel rather than cherry-picking the patch. Red Hat shipped fixes for RHEL 10 in **RHSA-2025:20095** and RHEL 9 in **RHSA-2025:20518**; the RHEL 9 real-time kernel fix remains deferred, while RHEL 8 kernel variants are outside the affected support scope. Red Hat rates the local, high-privilege denial-of-service issue 4.4 CVSS v3.1, compared with 5.5 ratings from NVD and CVE.org.
Aug 26, 2026
Red Hat released **RHSA-2024:4107**, a Moderate-severity kernel security and bug-fix update for Red Hat Enterprise Linux 8.6 deployments using Advanced Update Support, Telecommunications Update Service, Extended Life Cycle Long Life, and SAP update channels. The advisory delivers kernel version `4.18.0-372.109.1.el8_6` and remediates **CVE-2022-1048**, an ALSA PCM use-after-free race in `snd_pcm_hw_free` that a low-privileged local user could potentially use to crash a system or escalate privileges on systems exposing a relevant sound device. The update also addresses **CVE-2024-26993**, a reference leak in `sysfs_break_active_protection()`, and **CVE-2024-26642** in netfilter `nf_tables`. Red Hat assessed CVE-2024-26993 as preliminarily low impact, with no active exploitation or demonstrated impact reported. Administrators should install the updated kernel packages and reboot affected systems to activate the fixes; preventing the `snd-pcm` module from loading can mitigate CVE-2022-1048 where patching cannot occur immediately.
Aug 27, 2026
A **buffer overflow** in the Linux kernel's `ALSA firewire-motu` component was assigned **`CVE-2025-68347`** after maintainers found that `hwdep_read()` could copy more bytes to a user buffer than requested while processing DSP events. The flaw affects code introduced in kernel **5.16** and occurs when the supplied buffer is smaller than the 8-byte event header, resulting in an out-of-bounds write classified as **`CWE-787`**. Upstream kernel maintainers fixed the issue by clamping the copy length with `min_t()` in `sound/firewire/motu/motu-hwdep.c`. The Linux kernel CVE team said the bug has been resolved in multiple branches, including **6.12.63**, **6.17.13**, **6.18.2**, and **6.19-rc1**, and advised users to update to the latest stable kernel release instead of cherry-picking patches. Red Hat rated the vulnerability **Moderate** with a **CVSS v3 score of 7.1** and said fixes for **Red Hat Enterprise Linux 8** `kernel` and `kernel-rt` packages were released, while **RHEL 6, 7, 7 kernel-rt, 9, 9 kernel-rt, and 10** were listed as not affected because the vulnerable code is not present.
Aug 25, 2026