GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-44954 (GCVE-0-2024-44954)

Vulnerability from cvelistv5 – Published: 2024-09-04 18:35 – Updated: 2026-08-05 11:37
VLAI
Title
ALSA: line6: Fix racy access to midibuf
Summary
In the Linux kernel, the following vulnerability has been resolved: ALSA: line6: Fix racy access to midibuf There can be concurrent accesses to line6 midibuf from both the URB completion callback and the rawmidi API access. This could be a cause of KMSAN warning triggered by syzkaller below (so put as reported-by here). This patch protects the midibuf call of the former code path with a spinlock for avoiding the possible races.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 17:40 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 705ececd1c60d0f5d6ef2a719008847883516970 , < 643293b68fbb6c03f5e907736498da17d43f0d81 (git)
Affected: 705ececd1c60d0f5d6ef2a719008847883516970 , < 40f3d5cb0e0cbf7fa697913a27d5d361373bdcf5 (git)
Affected: 705ececd1c60d0f5d6ef2a719008847883516970 , < e7e7d2b180d8f297cea6db43ea72402fd33e1a29 (git)
Affected: 705ececd1c60d0f5d6ef2a719008847883516970 , < a54da4b787dcac60b598da69c9c0072812b8282d (git)
Affected: 705ececd1c60d0f5d6ef2a719008847883516970 , < c80f454a805443c274394b1db0d1ebf477abd94e (git)
Affected: 705ececd1c60d0f5d6ef2a719008847883516970 , < 535df7f896a568a8a1564114eaea49d002cb1747 (git)
Affected: 705ececd1c60d0f5d6ef2a719008847883516970 , < 51d87f11dd199bbc6a85982b088ff27bde53b48a (git)
Affected: 705ececd1c60d0f5d6ef2a719008847883516970 , < 15b7a03205b31bc5623378c190d22b7ff60026f1 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.30
Unaffected: 0 , < 2.6.30 (semver)
Unaffected: 4.19.320 , ≤ 4.19.* (semver)
Unaffected: 5.4.282 , ≤ 5.4.* (semver)
Unaffected: 5.10.224 , ≤ 5.10.* (semver)
Unaffected: 5.15.165 , ≤ 5.15.* (semver)
Unaffected: 6.1.105 , ≤ 6.1.* (semver)
Unaffected: 6.6.46 , ≤ 6.6.* (semver)
Unaffected: 6.10.5 , ≤ 6.10.* (semver)
Unaffected: 6.11 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-44954",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:40:10.329711Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:33:34.296Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:14:04.124Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/usb/line6/driver.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "643293b68fbb6c03f5e907736498da17d43f0d81",
              "status": "affected",
              "version": "705ececd1c60d0f5d6ef2a719008847883516970",
              "versionType": "git"
            },
            {
              "lessThan": "40f3d5cb0e0cbf7fa697913a27d5d361373bdcf5",
              "status": "affected",
              "version": "705ececd1c60d0f5d6ef2a719008847883516970",
              "versionType": "git"
            },
            {
              "lessThan": "e7e7d2b180d8f297cea6db43ea72402fd33e1a29",
              "status": "affected",
              "version": "705ececd1c60d0f5d6ef2a719008847883516970",
              "versionType": "git"
            },
            {
              "lessThan": "a54da4b787dcac60b598da69c9c0072812b8282d",
              "status": "affected",
              "version": "705ececd1c60d0f5d6ef2a719008847883516970",
              "versionType": "git"
            },
            {
              "lessThan": "c80f454a805443c274394b1db0d1ebf477abd94e",
              "status": "affected",
              "version": "705ececd1c60d0f5d6ef2a719008847883516970",
              "versionType": "git"
            },
            {
              "lessThan": "535df7f896a568a8a1564114eaea49d002cb1747",
              "status": "affected",
              "version": "705ececd1c60d0f5d6ef2a719008847883516970",
              "versionType": "git"
            },
            {
              "lessThan": "51d87f11dd199bbc6a85982b088ff27bde53b48a",
              "status": "affected",
              "version": "705ececd1c60d0f5d6ef2a719008847883516970",
              "versionType": "git"
            },
            {
              "lessThan": "15b7a03205b31bc5623378c190d22b7ff60026f1",
              "status": "affected",
              "version": "705ececd1c60d0f5d6ef2a719008847883516970",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/usb/line6/driver.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.30"
            },
            {
              "lessThan": "2.6.30",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.320",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.282",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.224",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.320",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.282",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.224",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.165",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.105",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.46",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.5",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: line6: Fix racy access to midibuf\n\nThere can be concurrent accesses to line6 midibuf from both the URB\ncompletion callback and the rawmidi API access.  This could be a cause\nof KMSAN warning triggered by syzkaller below (so put as reported-by\nhere).\n\nThis patch protects the midibuf call of the former code path with a\nspinlock for avoiding the possible races."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The unsynchronized accesses are in `line6_data_received()` (URB completion for the control/MIDI-in endpoint) racing the rawmidi API path, and the driver is only bound when a Line 6 device is already attached \u2014 so a local unprivileged user on such a host drives both halves via `/dev/snd/midiC*D*` (and the hwdep node), writing MIDI/sysex to solicit device replies that generate URB completions while concurrently hammering rawmidi read/trigger. No physical access by the attacker is needed in that deployment (audio workstation, live-performance rig).\nAC:L - The attacker controls both sides of the race \u2014 one thread issues rawmidi/hwdep writes that make the device respond on the interrupt-in endpoint, another thread concurrently exercises the rawmidi API \u2014 and the window can be retried indefinitely at MIDI packet rate. Per the guidance, a race whose both sides the attacker creates is Low.\nPR:L - Only ordinary access to the ALSA rawmidi/hwdep character devices is required, which the console/desktop user gets by default through udev ACLs or `audio` group membership. No CAP_SYS_ADMIN or root is needed.\nUI:N - The attacker performs every step itself \u2014 opening the rawmidi node, soliciting device traffic, and racing the accesses. Presence of the Line 6 device is a property of the affected system (the driver does not load otherwise), not a victim action during the attack.\nS:U - The corrupted ring-buffer state, the heap over-read, and the disclosed data all live in the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - syzbot confirmed \"KMSAN: uninit-value in line6_midibuf_read\" at `midibuf.c:185` \u2014 racy `pos_read`/`pos_write`/`full` make the reader consume bytes never written, so stale contents of the `kmalloc()`ed 1024-byte `midi_buffer.buf` slab object are memcpy\u0027d into `line6-\u003ebuffer_message` and delivered to userspace through `snd_rawmidi_receive()`. A stale `length1 = size - pos_write`/`pos_read` pair also lets the copy index past the end of that allocation, and the leak is repeatable, allowing kernel heap contents (pointers, recycled data) to be harvested.\nI:H - `line6_midibuf_write()` computes `length1 = this-\u003esize - this-\u003epos_write` and then does `memcpy(this-\u003ebuf + this-\u003epos_write, data, length1)` re-reading `pos_write`; with no lock, a concurrent index update makes that copy run past the end of the kmalloc-1024 object with device-supplied MIDI bytes, giving an attacker-influenced heap out-of-bounds write, and corrupted indices also feed bogus data into the rawmidi stream.\nA:H - Out-of-bounds reads and writes on the kmalloc-1024 slab object corrupt adjacent allocations and trip sanitizer/hardening checks, producing oops or panic. The bug is a memory-safety error, which per the guidance is High availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:37:18.083Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/643293b68fbb6c03f5e907736498da17d43f0d81"
        },
        {
          "url": "https://git.kernel.org/stable/c/40f3d5cb0e0cbf7fa697913a27d5d361373bdcf5"
        },
        {
          "url": "https://git.kernel.org/stable/c/e7e7d2b180d8f297cea6db43ea72402fd33e1a29"
        },
        {
          "url": "https://git.kernel.org/stable/c/a54da4b787dcac60b598da69c9c0072812b8282d"
        },
        {
          "url": "https://git.kernel.org/stable/c/c80f454a805443c274394b1db0d1ebf477abd94e"
        },
        {
          "url": "https://git.kernel.org/stable/c/535df7f896a568a8a1564114eaea49d002cb1747"
        },
        {
          "url": "https://git.kernel.org/stable/c/51d87f11dd199bbc6a85982b088ff27bde53b48a"
        },
        {
          "url": "https://git.kernel.org/stable/c/15b7a03205b31bc5623378c190d22b7ff60026f1"
        }
      ],
      "title": "ALSA: line6: Fix racy access to midibuf",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-44954",
    "datePublished": "2024-09-04T18:35:53.730Z",
    "dateReserved": "2024-08-21T05:34:56.666Z",
    "dateUpdated": "2026-08-05T11:37:18.083Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-44954",
      "date": "2026-09-16",
      "epss": "0.00179",
      "percentile": "0.07726"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"4.19.320\", \"matchCriteriaId\": \"0B4EF915-550B-45E5-B2CA-648FEACD60FC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartExcluding\": \"4.20\", \"versionEndExcluding\": \"5.4.282\", \"matchCriteriaId\": \"21D0A18B-9B7E-4C59-A2A6-8A94BBA4E0FD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.5\", \"versionEndExcluding\": \"5.10.224\", \"matchCriteriaId\": \"5CCEDF13-293D-4E64-B501-4409D0365AFE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartExcluding\": \"5.11\", \"versionEndExcluding\": \"5.15.165\", \"matchCriteriaId\": \"87C7E3B8-B82C-459E-AE23-FFE2D952481F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.16\", \"versionEndExcluding\": \"6.1.105\", \"matchCriteriaId\": \"89BEB24B-0F37-4C92-A397-564DA7CD8EE9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2\", \"versionEndExcluding\": \"6.6.46\", \"matchCriteriaId\": \"FA11941E-81FB-484C-B583-881EEB488340\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.10.5\", \"matchCriteriaId\": \"D074AE50-4A5E-499C-A2FD-75FD60DEA560\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"8B3CE743-2126-47A3-8B7C-822B502CF119\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"4DEB27E7-30AA-45CC-8934-B89263EF3551\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nALSA: line6: Fix racy access to midibuf\\n\\nThere can be concurrent accesses to line6 midibuf from both the URB\\ncompletion callback and the rawmidi API access.  This could be a cause\\nof KMSAN warning triggered by syzkaller below (so put as reported-by\\nhere).\\n\\nThis patch protects the midibuf call of the former code path with a\\nspinlock for avoiding the possible races.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ALSA: line6: Fix racy access to midibuf Puede haber accesos concurrentes a midibuf de line6 tanto desde la devoluci\\u00f3n de llamada de finalizaci\\u00f3n de URB como desde el acceso a la API rawmidi. Esto podr\\u00eda ser la causa de la advertencia KMSAN activada por syzkaller a continuaci\\u00f3n (as\\u00ed que se indica aqu\\u00ed). Este parche protege la llamada midibuf de la ruta de c\\u00f3digo anterior con un spinlock para evitar las posibles ejecuciones.\"}]",
      "id": "CVE-2024-44954",
      "lastModified": "2024-10-10T18:02:42.307",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 4.7, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.0, \"impactScore\": 3.6}]}",
      "published": "2024-09-04T19:15:30.353",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/15b7a03205b31bc5623378c190d22b7ff60026f1\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/40f3d5cb0e0cbf7fa697913a27d5d361373bdcf5\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/51d87f11dd199bbc6a85982b088ff27bde53b48a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/535df7f896a568a8a1564114eaea49d002cb1747\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/643293b68fbb6c03f5e907736498da17d43f0d81\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/a54da4b787dcac60b598da69c9c0072812b8282d\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/c80f454a805443c274394b1db0d1ebf477abd94e\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/e7e7d2b180d8f297cea6db43ea72402fd33e1a29\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-362\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T14:04:50.000Z",
      "cve": "CVE-2024-44954",
      "id": "msrc_CVE-2024-44954",
      "initial_release_date": "2024-09-01T07:00:00.000Z",
      "product_status:fixed": "3",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ALSA: line6: Fix racy access to midibuf",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-44954.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-44954\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-09-04T19:15:30.353\",\"lastModified\":\"2026-08-04T11:20:03.913\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nALSA: line6: Fix racy access to midibuf\\n\\nThere can be concurrent accesses to line6 midibuf from both the URB\\ncompletion callback and the rawmidi API access.  This could be a cause\\nof KMSAN warning triggered by syzkaller below (so put as reported-by\\nhere).\\n\\nThis patch protects the midibuf call of the former code path with a\\nspinlock for avoiding the possible races.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ALSA: line6: Fix racy access to midibuf Puede haber accesos concurrentes a midibuf de line6 tanto desde la devoluci\u00f3n de llamada de finalizaci\u00f3n de URB como desde el acceso a la API rawmidi. Esto podr\u00eda ser la causa de la advertencia KMSAN activada por syzkaller a continuaci\u00f3n (as\u00ed que se indica aqu\u00ed). Este parche protege la llamada midibuf de la ruta de c\u00f3digo anterior con un spinlock para evitar las posibles ejecuciones.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"sound/usb/line6/driver.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"705ececd1c60d0f5d6ef2a719008847883516970\",\"lessThan\":\"643293b68fbb6c03f5e907736498da17d43f0d81\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"705ececd1c60d0f5d6ef2a719008847883516970\",\"lessThan\":\"40f3d5cb0e0cbf7fa697913a27d5d361373bdcf5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"705ececd1c60d0f5d6ef2a719008847883516970\",\"lessThan\":\"e7e7d2b180d8f297cea6db43ea72402fd33e1a29\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"705ececd1c60d0f5d6ef2a719008847883516970\",\"lessThan\":\"a54da4b787dcac60b598da69c9c0072812b8282d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"705ececd1c60d0f5d6ef2a719008847883516970\",\"lessThan\":\"c80f454a805443c274394b1db0d1ebf477abd94e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"705ececd1c60d0f5d6ef2a719008847883516970\",\"lessThan\":\"535df7f896a568a8a1564114eaea49d002cb1747\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"705ececd1c60d0f5d6ef2a719008847883516970\",\"lessThan\":\"51d87f11dd199bbc6a85982b088ff27bde53b48a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"705ececd1c60d0f5d6ef2a719008847883516970\",\"lessThan\":\"15b7a03205b31bc5623378c190d22b7ff60026f1\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"sound/usb/line6/driver.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.30\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.30\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.320\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.282\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.224\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.165\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.105\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.46\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.5\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T17:40:10.329711Z\",\"id\":\"CVE-2024-44954\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"4.19.320\",\"matchCriteriaId\":\"0B4EF915-550B-45E5-B2CA-648FEACD60FC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartExcluding\":\"4.20\",\"versionEndExcluding\":\"5.4.282\",\"matchCriteriaId\":\"21D0A18B-9B7E-4C59-A2A6-8A94BBA4E0FD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.224\",\"matchCriteriaId\":\"5CCEDF13-293D-4E64-B501-4409D0365AFE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartExcluding\":\"5.11\",\"versionEndExcluding\":\"5.15.165\",\"matchCriteriaId\":\"87C7E3B8-B82C-459E-AE23-FFE2D952481F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.105\",\"matchCriteriaId\":\"89BEB24B-0F37-4C92-A397-564DA7CD8EE9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.46\",\"matchCriteriaId\":\"FA11941E-81FB-484C-B583-881EEB488340\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.5\",\"matchCriteriaId\":\"D074AE50-4A5E-499C-A2FD-75FD60DEA560\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8B3CE743-2126-47A3-8B7C-822B502CF119\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4DEB27E7-30AA-45CC-8934-B89263EF3551\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/15b7a03205b31bc5623378c190d22b7ff60026f1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/40f3d5cb0e0cbf7fa697913a27d5d361373bdcf5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/51d87f11dd199bbc6a85982b088ff27bde53b48a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/535df7f896a568a8a1564114eaea49d002cb1747\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/643293b68fbb6c03f5e907736498da17d43f0d81\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a54da4b787dcac60b598da69c9c0072812b8282d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c80f454a805443c274394b1db0d1ebf477abd94e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e7e7d2b180d8f297cea6db43ea72402fd33e1a29\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:18:02+00:00",
      "cve": "CVE-2024-44954",
      "id": "CVE-2024-44954",
      "initial_release_date": "2024-09-04T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ALSA: line6: Fix racy access to midibuf",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-44954.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-30T02:26:18Z",
      "cve": "CVE-2024-44954",
      "id": "CVE-2024-44954",
      "initial_release_date": "2024-09-05T02:47:14Z",
      "product_status:known_affected": "624",
      "product_status:known_not_affected": "15",
      "product_status:recommended": "724",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-44954",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-44954.json",
      "version": "55"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:14:04.124Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-44954\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T17:40:10.329711Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:24.811Z\"}}], \"cna\": {\"title\": \"ALSA: line6: Fix racy access to midibuf\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"705ececd1c60d0f5d6ef2a719008847883516970\", \"lessThan\": \"643293b68fbb6c03f5e907736498da17d43f0d81\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"705ececd1c60d0f5d6ef2a719008847883516970\", \"lessThan\": \"40f3d5cb0e0cbf7fa697913a27d5d361373bdcf5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"705ececd1c60d0f5d6ef2a719008847883516970\", \"lessThan\": \"e7e7d2b180d8f297cea6db43ea72402fd33e1a29\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"705ececd1c60d0f5d6ef2a719008847883516970\", \"lessThan\": \"a54da4b787dcac60b598da69c9c0072812b8282d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"705ececd1c60d0f5d6ef2a719008847883516970\", \"lessThan\": \"c80f454a805443c274394b1db0d1ebf477abd94e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"705ececd1c60d0f5d6ef2a719008847883516970\", \"lessThan\": \"535df7f896a568a8a1564114eaea49d002cb1747\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"705ececd1c60d0f5d6ef2a719008847883516970\", \"lessThan\": \"51d87f11dd199bbc6a85982b088ff27bde53b48a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"705ececd1c60d0f5d6ef2a719008847883516970\", \"lessThan\": \"15b7a03205b31bc5623378c190d22b7ff60026f1\", \"versionType\": \"git\"}], \"programFiles\": [\"sound/usb/line6/driver.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.30\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.30\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.320\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.282\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.224\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.165\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.105\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.46\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"sound/usb/line6/driver.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/643293b68fbb6c03f5e907736498da17d43f0d81\"}, {\"url\": \"https://git.kernel.org/stable/c/40f3d5cb0e0cbf7fa697913a27d5d361373bdcf5\"}, {\"url\": \"https://git.kernel.org/stable/c/e7e7d2b180d8f297cea6db43ea72402fd33e1a29\"}, {\"url\": \"https://git.kernel.org/stable/c/a54da4b787dcac60b598da69c9c0072812b8282d\"}, {\"url\": \"https://git.kernel.org/stable/c/c80f454a805443c274394b1db0d1ebf477abd94e\"}, {\"url\": \"https://git.kernel.org/stable/c/535df7f896a568a8a1564114eaea49d002cb1747\"}, {\"url\": \"https://git.kernel.org/stable/c/51d87f11dd199bbc6a85982b088ff27bde53b48a\"}, {\"url\": \"https://git.kernel.org/stable/c/15b7a03205b31bc5623378c190d22b7ff60026f1\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nALSA: line6: Fix racy access to midibuf\\n\\nThere can be concurrent accesses to line6 midibuf from both the URB\\ncompletion callback and the rawmidi API access.  This could be a cause\\nof KMSAN warning triggered by syzkaller below (so put as reported-by\\nhere).\\n\\nThis patch protects the midibuf call of the former code path with a\\nspinlock for avoiding the possible races.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.320\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.282\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.224\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.165\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.105\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.46\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.5\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11\", \"versionStartIncluding\": \"2.6.30\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:32:40.110Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-44954\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T20:32:40.110Z\", \"dateReserved\": \"2024-08-21T05:34:56.666Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-09-04T18:35:53.730Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.