Linux Kernel CVE-2024-26799

Exploitation requires local access to the target system running on Qualcomm SoC hardware with the LPASS CDC DMA audio driver compiled in or loaded (sound/soc/qcom/lpass-cdc-dma.c). The attacker must be able to trigger an invocation of __lpass_get_dmactl_handle with an invalid dai_id - this implies access to the ALSA audio interface at PR:L (low privilege). The CVSS AC:H rating reflects that the hardware-specific driver must be present and active, significantly narrowing the attack surface to Qualcomm-based platforms (embedded Linux, Android). Exploitation beyond a kernel crash is further constrained by kernel hardening features (KASLR, SMEP, SMAP) present in modern distributions. There is no requirement for user interaction (UI:N), but the specific hardware dependency is the primary limiting factor for real-world exposure.

Despite a CVSS base score of 7.0 and a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, the real-world exploitation risk is low. EPSS at 0.23% (14th percentile) reflects minimal exploitation interest from the threat intelligence community. This CVE is not listed in CISA KEV, and no public proof-of-concept exploit is identified. The CVSS high-complexity (AC:H) rating is appropriate: triggering this path requires the caller to supply an invalid dai_id on a system with QCOM LPASS CDC DMA audio hardware, making it highly hardware-specific and not broadly exploitable. The C:H/I:H/A:H impact ratings represent theoretical worst-case outcomes - a garbage pointer that passes the null check could lead to a stale memory dereference, kernel oops, or if KASLR is defeated, controlled memory writes - but these scenarios are technically demanding. In practice, the most realistic outcome is a kernel crash (DoS). This is primarily a defensive code-quality fix surfaced by static analysis, and while the CVSS score is technically defensible, it is likely not an operational priority compared to actively exploited vulnerabilities.

A local attacker with low-privilege access on a Qualcomm-based embedded Linux system (e.g., an Android device, Snapdragon-based IoT platform) triggers the vulnerable code path by causing the audio subsystem to call __lpass_get_dmactl_handle with an invalid Digital Audio Interface ID (dai_id). The garbage dmactl pointer passes the null check and is subsequently dereferenced, causing either a kernel oops/crash or, under favorable memory layout conditions, a controlled access to an attacker-influenced memory region. No public proof-of-concept is available, and exploitation beyond a DoS would require defeating kernel hardening mitigations such as KASLR.