Vulnerability in Kernel (CVE-2024-50104)

Summary

Vulnerability in Kernel (CVE-2024-50104). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 6.11.6 or later.

Original description

The description as published by the source.

In the Linux kernel, the following vulnerability has been resolved:

ASoC: qcom: sdm845: add missing soundwire runtime stream alloc

During the migration of Soundwire runtime stream allocation from
the Qualcomm Soundwire controller to SoC's soundcard drivers the sdm845
soundcard was forgotten.

At this point any playback attempt or audio daemon startup, for instance
on sdm845-db845c (Qualcomm RB3 board), will result in stream pointer
NULL dereference:

Unable to handle kernel NULL pointer dereference at virtual
address 0000000000000020
Mem abort info:
ESR = 0x0000000096000004
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x04: level 0 translation fault
Data abort info:
ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
CM = 0, WnR = 0, TnD = 0, TagAccess = 0
GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
user pgtable: 4k pages, 48-bit VAs, pgdp=0000000101ecf000
[0000000000000020] pgd=0000000000000000, p4d=0000000000000000
Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
Modules linked in: ...
CPU: 5 UID: 0 PID: 1198 Comm: aplay
Not tainted 6.12.0-rc2-qcomlt-arm64-00059-g9d78f315a362-dirty #18
Hardware name: Thundercomm Dragonboard 845c (DT)
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : sdw_stream_add_slave+0x44/0x380 [soundwire_bus]
lr : sdw_stream_add_slave+0x44/0x380 [soundwire_bus]
sp : ffff80008a2035c0
x29: ffff80008a2035c0 x28: ffff80008a203978 x27: 0000000000000000
x26: 00…

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Auto-generated summary

Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.

A vulnerability tracked as CVE-2024-50104 has been found in Kernel.
Risk of unauthorized operations or information disclosure.
What to do: upgrade Kernel to 6.11.6 or later.
If unsure, ask your IT team or search "Kernel CVE-2024-50104" on the vendor's site.

CVE-2024-50104 (Kernel)
Attack vector: local / no user interaction
Patched: 6.11.6 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.

❓ What is the problem

A vulnerability (unclassified) exists in Kernel.

📍 Affected scope

Check the vendor advisory for the affected versions of Kernel.

🔥 Severity

Severity: ?. Risk of unauthorized operations or information disclosure.

🔧 How to fix

Update to 6.11.6.

🛡️ Workaround

Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.

🔍 Detection

Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'Kernel' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

1
Identify exposure identify
```
grep -r 'Kernel' . | grep -v node_modules
```
リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で Kernel を grep し、稼働しているサービス・バージョンを把握する。
2
Apply patch patch
```
Upgrade Kernel to 6.11.6
```
ステージング環境で 6.11.6 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
3
Post-deployment verification verify
```
Confirm patched version is live in production
```
パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。

Affected packages

Linux Kernel

[{"type":"ECOSYSTEM","events":[{"introduced":"6.8.0"},{"fixed":"6.11.6"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2024-50104 linux Fixed in: 6.11.6-1
Ubuntu UBUNTU-CVE-2024-50104 linux-hwe-edge