CVE-2023-54096

A flaw was found in the Linux kernel's soundwire subsystem. The code responsible for managing device enumeration completion, which allows drivers to synchronize with soundwire devices, contains a defect. This issue can lead to memory corruption if drivers are still waiting for completion, as the system fails to signal all processes and uses an incorrect reinitialization function.

A moderate-impact flaw was found in the Linux kernel soundwire subsystem as shipped in Red Hat Enterprise Linux 8 and Red Hat Enterprise Linux 9. The signalling code in drivers/soundwire/bus.c that lets drivers wait for a soundwire device to become enumerated on the bus and initialised does not signal all current and future waiters, and it reinitialises the completion structures with the wrong function. If drivers are still waiting on the completion queue when the structure is reinitialised, kernel memory can be corrupted, affecting integrity and availability but not confidentiality (Red Hat CVSS 6.1, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H). The missing signalling also breaks sound card probe deferrals, because codec drivers cannot tell that a soundwire device is already attached when being reprobed, and can cause codec runtime PM resume paths to time out despite the device already being enumerated. Exploitation requires local access and specific timing of soundwire device enumeration, so practical exposure is limited to systems using soundwire-attached audio devices. Red Hat Enterprise Linux 6, 7, 8.2, 8.10, 9.4 and later, 10, and Red Hat In-Vehicle OS ship kernels in which the vulnerable code is not present and are therefore not affected. The affected RHEL 8 (8.4, 8.6, 8.8) and RHEL 9 (9.0, 9.2) kernel and kernel-rt z-streams have a deferred fix: because the flaw is rated moderate severity and triggering it requires local access and a narrow soundwire enumeration race, a fix is not currently scheduled for those older z-streams and may be considered in a future update. Until a fixed kernel is delivered on those streams, the residual risk is potential kernel memory corruption on systems using soundwire devices. The CVE.org severity of 7.8 (High) is higher than the Red Hat rating of moderate because Red Hat's scoring reflects no confidentiality impact and the constrained local conditions required to trigger the issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.