What is the CVSS score of CVE-2024-38628?

CVE-2024-38628 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2024-38628?

CVE-2024-38628 in the Linux kernel USB gadget audio driver enables local privilege escalation, creating a path for low-privileged users to gain unauthorized administrative access to affected systems.. A patch is available.

How to fix or mitigate CVE-2024-38628?

Within 24 hours, identify and inventory systems running vulnerable Linux kernels with USB gadget audio (u_audio) support enabled, prioritizing multi-user systems and shared infrastructure. Within 7 days, apply the available vendor-released Linux kernel patch to all affected systems and schedule controlled reboots to activate the patched kernel. Within 30 days, complete patch verification across all identified systems, document remediation completion in your patch management system, and assess whether USB gadget audio functionality is required on each system.

Linux Kernel CVE-2024-38628

HIGH

Race Condition (CWE-362)

2024-06-21 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Information Disclosure Linux Race Condition

7.8

CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Race condition requires precise timing to win (AC:H); local low-privilege access needed to trigger gadget unbind; full memory impact if race is won.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 04, 2026 - 11:52 vuln.today

v2 (cvss_changed)

Analysis Updated

Aug 04, 2026 - 11:46 vuln.today

v1 (cvss_changed)

Re-analysis Queued

Aug 04, 2026 - 11:23 vuln.today

cvss_changed

Severity Changed

Aug 04, 2026 - 11:23 NVD

MEDIUM HIGH

CVSS changed

Aug 04, 2026 - 11:23 NVD

5.5 (MEDIUM) 7.8 (HIGH)

CVE Published

Jun 21, 2024 - 11:15 cve.org

MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: u_audio: Fix race condition use of controls after free during gadget unbind.

Hang on to the control IDs instead of pointers since those are correctly handled with locks.

AnalysisAI

Use-after-free via race condition in the Linux kernel's USB gadget audio driver (u_audio) allows a local low-privileged user to corrupt kernel memory during gadget unbind operations. The flaw exists because audio control pointers were accessed concurrently without adequate locking after the underlying memory was freed during device unbind, a classic CWE-362 time-of-check/time-of-use pattern. EPSS is low (0.17%, 7th percentile) and CISA KEV does not list this CVE, but the CVSS C:H/I:H/A:H rating reflects potential for local privilege escalation via memory corruption.

Technical ContextAI

The affected component is the u_audio USB gadget driver within the Linux kernel (cpe:2.3:o:linux:linux_kernel). USB gadget drivers implement device-side USB functionality, and u_audio enables a Linux system to present itself as a USB audio device. ALSA mixer controls are registered at gadget bind time; during unbind, the driver frees associated memory. The race occurs when another kernel thread accesses control pointers after free but before the gadget is fully unbound - a CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization) root cause. The upstream fix substitutes control IDs (safe integer handles) for raw pointers, and enforces access through properly-locked paths, eliminating the dangling-pointer window.

RemediationAI

Update to a Linux kernel version that includes one of the four upstream stable patches: https://git.kernel.org/stable/c/1b739388aa3f8dfb63a9fca777e6dfa6912d0464, https://git.kernel.org/stable/c/453d3fa9266e53f85377b911c19b9a4563fa88c0, https://git.kernel.org/stable/c/89e66809684485590ea0b32c3178e42cba36ac09, or https://git.kernel.org/stable/c/bea73b58ab67fe581037ad9cdb93c2557590c068. Distribution maintainers (Debian, Ubuntu, RHEL, SUSE, etc.) should be consulted for stable-release kernel updates incorporating these commits. As a compensating control where patching is not immediately possible, disabling the USB gadget audio subsystem via kernel module blacklisting (blacklist u_audio in /etc/modprobe.d/) eliminates the vulnerable code path with the trade-off of losing USB audio gadget functionality. Restricting unprivileged access to gadget configuration (e.g., via configfs permissions) reduces the exposure surface but does not eliminate the race for privileged users.