CVE-2024-46863

A flaw was found in the Linux kernel's support for Intel sound cards which could result in a denial of service.

A Moderate-severity flaw in the Linux kernel's ASoC support for Intel sound cards can result in a denial of service on systems equipped with the affected Intel Lunar Lake SoundWire audio hardware. The Intel Lunar Lake machine-driver match table (sound/soc/intel/common/soc-acpi-intel-lnl-match.c) is missing the empty terminating item required at the end of its struct snd_soc_acpi_link_adr array. Because hda_sdw_machine_select() relies on encountering a link with no num_adr to end its loop, the missing empty item causes the loop to read past the end of the array while matching audio hardware, which can result in a denial of service (kernel crash). The affected code was introduced upstream in Linux 6.10. Within Red Hat Enterprise Linux 9, the kernel and kernel-rt packages are affected and remediation is delegated to the Red Hat kernel team; for the older affected RHEL 9 streams the kernel team has decided not to provide a fix, leaving a residual risk of local denial of service limited to systems with the affected Intel sound hardware. Fedora is also affected. Red Hat Enterprise Linux 6, 7, and 8 and the hosted OpenShift offerings are not affected because their kernels do not include the affected Intel Lunar Lake SoundWire match code. Red Hat's severity assessment is lower than the external ratings published by NIST (5.5, Moderate) and CVE.org (7.3, Important): the Red Hat CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L, score 2.3) reflects that the flaw is local, requires high privileges, and affects only availability, whereas the CVE.org vector additionally claims confidentiality and integrity impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.