Executive Summary

This vulnerability exists in the Linux kernel's ALSA aloop (audio loopback) component. It involves a use-after-free (UAF) issue during a format-change stop operation. Specifically, when playback starts with parameters that no longer match a running capture stream, the function loopback_check_format() may stop the capture side. Although a previous fix moved the peer lookup under a lock, the actual stop operation (snd_pcm_stop()) still occurs after releasing that lock. This can lead to a race condition where a concurrent close clears and frees the capture runtime while the playback trigger path still holds a stale pointer to the peer substream, causing a use-after-free.

The fix involves keeping a per-cable count of in-flight peer stops before releasing the lock and making the free_cable() function wait for those stops to complete before detaching the runtime. This ensures the peer runtime lifetime is managed explicitly and prevents the use-after-free condition.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to a use-after-free condition in the ALSA aloop audio subsystem of the Linux kernel. Such a condition may cause system instability, crashes, or potentially allow an attacker to execute arbitrary code or cause denial of service by exploiting the stale pointer to freed memory.

Useful 0 Not Useful 0