What is the CVSS score of CVE-2024-38388?

CVE-2024-38388 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2024-38388?

A critical memory corruption vulnerability in the Linux kernel's Cirrus Logic audio driver (CVE-2024-38388) creates kernel compromise risk for organizations operating multi-user or shared Linux…. A patch is available.

How to fix or mitigate CVE-2024-38388?

Within 24 hours, conduct an inventory of all Linux systems utilizing Cirrus Logic ALSA HDA DSP audio drivers, prioritizing production environments and multi-user systems. Within 7 days, apply Linux kernel security patches addressing CVE-2024-38388 from your distribution's security repository (patches are available from Linux kernel maintainers and backported to all supported kernel versions). Within 30 days, verify patching completion across all systems, validate audio subsystem functionality, and document updates for compliance records.

Linux Kernel CVE-2024-38388

HIGH

Memory Leak (CWE-401)

2024-06-21 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Information Disclosure Linux

7.8

CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local access with low privileges required to trigger driver unload and stale control access; successful kernel memory corruption yields full confidentiality, integrity, and availability impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 04, 2026 - 11:57 vuln.today

v2 (cvss_changed)

Analysis Updated

Aug 04, 2026 - 11:49 vuln.today

v1 (cvss_changed)

Re-analysis Queued

Aug 04, 2026 - 11:23 vuln.today

cvss_changed

Severity Changed

Aug 04, 2026 - 11:23 NVD

LOW HIGH

CVSS changed

Aug 04, 2026 - 11:23 NVD

3.3 (LOW) 7.8 (HIGH)

CVE Published

Jun 21, 2024 - 11:15 cve.org

LOW 3.3

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ALSA: hda/cs_dsp_ctl: Use private_free for control cleanup

Use the control private_free callback to free the associated data block. This ensures that the memory won't leak, whatever way the control gets destroyed.

The original implementation didn't actually remove the ALSA controls in hda_cs_dsp_control_remove(). It only freed the internal tracking structure. This meant it was possible to remove/unload the amp driver while leaving its ALSA controls still present in the soundcard. Obviously attempting to access them could cause segfaults or at least dereferencing stale pointers.

AnalysisAI

Stale pointer dereference in the Linux kernel's ALSA HDA Cirrus Logic DSP (CS DSP) audio driver allows a local low-privileged attacker to trigger kernel memory corruption by accessing orphaned ALSA sound controls after the amp driver is unloaded. The flaw originates in hda_cs_dsp_control_remove() failing to call snd_ctl_remove(), leaving ALSA controls registered with the soundcard while their backing memory is freed - exposing a dangling private_data pointer accessible via standard ALSA interfaces. No public exploit code has been identified and EPSS scores this at 0.22% (12th percentile), though the CVSS 7.8 score accurately reflects the potential for full kernel compromise if exploitation succeeds on hardware-eligible systems.

Technical ContextAI

The vulnerability resides in the Advanced Linux Sound Architecture (ALSA) High Definition Audio (HDA) subsystem, specifically in the Cirrus Logic CS DSP control driver (sound/pci/hda/cs_dsp_ctl.c). The function hda_cs_dsp_control_remove() was responsible for cleaning up CS DSP controls when the amplifier driver was removed or unloaded. CWE-401 (Missing Release of Memory after Effective Lifetime) is the root cause classification, but the practical impact extends beyond a simple memory leak: the function freed the internal tracking data structure without calling snd_ctl_remove() to unregister the ALSA control from the soundcard. This left the ALSA control still registered and userspace-accessible, with its kcontrol->private_data pointer referencing freed memory. The fix introduces the control private_free callback - a standard ALSA lifecycle hook that ensures cleanup runs regardless of how the control is eventually destroyed, atomically coupling data lifetime to control lifetime and eliminating the window between driver unload and stale control access.

RemediationAI

Apply the upstream kernel stable-branch patches confirmed at https://git.kernel.org/stable/c/172811e3a557d8681a5e2d0f871dc04a2d17eb13, https://git.kernel.org/stable/c/191dc1b2ff0fb35e7aff15a53224837637df8bff, https://git.kernel.org/stable/c/3291486af5636540980ea55bae985f3eaa5b0740, and https://git.kernel.org/stable/c/6e359be4975006ff72818e79dad8fe48293f2eb2. Exact patched kernel release version numbers per distribution are not independently confirmed from available data - monitor your Linux distributor's security advisories (Ubuntu USN, Red Hat RHSA, SUSE SA, Debian DSA) for packaged kernel updates incorporating these commits. As a compensating control where patching is delayed, administrators can prevent dynamic unloading of the CS DSP HDA driver module by adding it to /etc/modprobe.d/ with 'install snd-hda-codec-cs8409 /bin/true' or using systemd module configuration to block rmmod - this eliminates the primary trigger path (driver unload while controls persist) at the cost of preventing dynamic audio driver management and requiring a reboot to change audio configuration. This workaround does not eliminate the underlying memory management flaw.