CVE-2024-44954

In the Linux kernel, the following vulnerability has been resolved:

ALSA: line6: Fix racy access to midibuf

There can be concurrent accesses to line6 midibuf from both the URB completion callback and the rawmidi API access. This could be a cause of KMSAN warning triggered by syzkaller below (so put as reported-by here).

This patch protects the midibuf call of the former code path with a spinlock for avoiding the possible races.

This flaw is evaluated as having a Moderate impact for Red Hat Enterprise Linux because exploitation is confined to a local denial-of-service condition and requires access to specialized Line 6 USB audio hardware or an emulated equivalent. In standard enterprise environments, such consumer audio peripherals are rarely connected, significantly reducing exposure. A local attacker triggering concurrent transfers across the raw MIDI interface and URB completion handler can cause a kernel crash, but confidentiality and integrity remain uncompromised.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.