What is the CVSS score of CVE-2024-26799?

CVE-2024-26799 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2024-26799?

CVE-2024-26799 affects the Qualcomm audio driver in the Linux kernel, enabling local attackers to crash systems or corrupt memory through an uninitialized pointer flaw.. A patch is available.

How to fix or mitigate CVE-2024-26799?

Within 24 hours: Identify all Qualcomm-based Linux systems and IoT devices in inventory; coordinate with device manufacturers to confirm patch availability timelines. Within 7 days: Evaluate and test vendor-released kernel patches in staging environments, with particular focus on Qualcomm audio subsystem stability. Within 30 days: Deploy patches to production systems, prioritizing high-availability infrastructure and user-facing devices.

Linux Kernel CVE-2024-26799

HIGH

Access of Uninitialized Pointer (CWE-824)

2024-04-04 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Information Disclosure Linux Memory Corruption

7.0

CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Local access and low privilege required; high complexity due to specific QCOM hardware and invalid DAI ID trigger condition; worst-case kernel pointer dereference enables C/I/A:H.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 04, 2026 - 13:29 vuln.today

v3 (cvss_changed)

Analysis Updated

Aug 04, 2026 - 13:28 vuln.today

v2 (cvss_changed)

Analysis Updated

Aug 04, 2026 - 13:28 vuln.today

v1 (cvss_changed)

Re-analysis Queued

Aug 04, 2026 - 11:23 vuln.today

cvss_changed

Severity Changed

Aug 04, 2026 - 11:23 NVD

MEDIUM HIGH

CVSS changed

Aug 04, 2026 - 11:23 NVD

6.2 (MEDIUM) 7.0 (HIGH)

CVE Published

Apr 04, 2024 - 09:15 cve.org

MEDIUM 6.2

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ASoC: qcom: Fix uninitialized pointer dmactl

In the case where __lpass_get_dmactl_handle is called and the driver id dai_id is invalid the pointer dmactl is not being assigned a value, and dmactl contains a garbage value since it has not been initialized and so the null check may not work. Fix this to initialize dmactl to NULL. One could argue that modern compilers will set this to zero, but it is useful to keep this initialized as per the same way in functions __lpass_platform_codec_intf_init and lpass_cdc_dma_daiops_hw_params.

Cleans up clang scan build warning: sound/soc/qcom/lpass-cdc-dma.c:275:7: warning: Branch condition evaluates to a garbage value [core.uninitialized.Branch]

AnalysisAI

Uninitialized pointer access in the Linux kernel's QCOM ASoC LPASS CDC DMA audio driver allows a local low-privileged attacker on Qualcomm hardware to potentially corrupt kernel memory or crash the system. The function __lpass_get_dmactl_handle in sound/soc/qcom/lpass-cdc-dma.c fails to initialize the dmactl pointer to NULL before a conditional branch, meaning an invalid dai_id causes the branch to evaluate against a garbage stack value rather than a defined null sentinel. No public exploit exists and EPSS sits at just 0.23% (14th percentile), indicating very low real-world exploitation interest despite a CVSS base score of 7.0.

Technical ContextAI

The flaw resides in the ASoC (ALSA System on Chip) subsystem's Qualcomm LPASS (Low Power Audio SubSystem) CDC DMA driver, file sound/soc/qcom/lpass-cdc-dma.c. CWE-824 (Access of Uninitialized Pointer) describes the root cause: the local variable dmactl is declared but not initialized to NULL prior to a conditional null check. If an invalid dai_id is passed to __lpass_get_dmactl_handle, the assignment branch that would set dmactl is skipped, and the subsequent null check evaluates against whatever garbage value the stack happens to contain. On Qualcomm SoCs, LPASS provides the DMA engine for audio codec data; the dmactl handle structure controls DMA channel configuration. The affected CPEs are Linux kernel versions spanning pre-release 6.8-rc1 through 6.8-rc6, plus a broad wildcard range of prior stable kernels, as indicated by the NVD CPE data. Clang's scan-build static analyzer flagged this as: 'Branch condition evaluates to a garbage value [core.uninitialized.Branch]'.

RemediationAI

Apply the upstream kernel patches provided via the three stable-tree commits referenced in NVD: https://git.kernel.org/stable/c/1382d8b55129875b2e07c4d2a7ebc790183769ee, https://git.kernel.org/stable/c/99adc8b4d2f38bf0d06483ec845bc48f60c3f8cf, and https://git.kernel.org/stable/c/d5a7726e6ea62d447b79ab5baeb537ea6bdb225b. The fix is a one-line initialization of dmactl to NULL, consistent with the coding pattern already used in __lpass_platform_codec_intf_init and lpass_cdc_dma_daiops_hw_params. Distributions tracking stable kernel series (e.g., Debian, Ubuntu, RHEL) should package these fixes in kernel updates; verify with your distribution's security advisories. As a compensating control, systems that do not use Qualcomm LPASS CDC DMA audio hardware can disable the driver module (CONFIG_SND_SOC_LPASS_CDC_DMA=n at build time or blacklist the module at runtime with 'blacklist lpass-cdc-dma' in /etc/modprobe.d/), eliminating exposure entirely with no functional impact on non-QCOM audio stacks. A released patched kernel version number is not independently confirmed from the available input data.