cve/2024/CVE-2024-26654.md

### [CVE-2024-26654](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26654)
![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=198de43d758c%3C%20eeb2a2ca0b8d%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)

### Description

In the Linux kernel, the following vulnerability has been resolved:ALSA: sh: aica: reorder cleanup operations to avoid UAF bugsThe dreamcastcard->timer could schedule the spu_dma_work and thespu_dma_work could also arm the dreamcastcard->timer.When the snd_pcm_substream is closing, the aica_channel will bedeallocated. But it could still be dereferenced in the workerthread. The reason is that del_timer() will return directlyregardless of whether the timer handler is running or not andthe worker could be rescheduled in the timer handler. As a result,the UAF bug will happen. The racy situation is shown below:      (Thread 1)                 |      (Thread 2)snd_aicapcm_pcm_close()          | ...                             |  run_spu_dma() //worker                                 |    mod_timer()  flush_work()                   |  del_timer()                    |  aica_period_elapsed() //timer  kfree(dreamcastcard->channel)  |    schedule_work()                                 |  run_spu_dma() //worker  ...                            |    dreamcastcard->channel-> //USEIn order to mitigate this bug and other possible corner cases,call mod_timer() conditionally in run_spu_dma(), then implementPCM sync_stop op to cancel both the timer and worker. The sync_stopop will be called from PCM core appropriately when needed.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/fkie-cad/nvd-json-data-feeds