CVE-2024-42274: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability in the Linux kernel's ALSA firewire-lib component was discovered and resolved. The issue stemmed from a previous commit (7ba5ca32fe6e) that removed the process context workqueue from certain functions to reduce overhead. This change affected systems using RME Fireface 800 since Linux kernel version 5.14.0 (Kernel Commit).

The vulnerability manifested as an AB/BA deadlock competition for the substream lock, which could lead to system freezes during ALSA operations. The deadlock occurred between two threads: one acquiring the substream lock through snd_pcm_stream_lock_irq() in snd_pcm_status64() and waiting for tasklet completion, while another thread entered the tasklet and attempted to acquire the same substream lock through snd_pcm_period_elapsed() (Kernel Commit).

When exploited, this vulnerability could cause a system freeze under ALSA operations, particularly affecting systems using RME Fireface 800 audio interfaces. The issue resulted in a complete deadlock of the audio subsystem, requiring a system restart to recover (Kernel Commit).

The issue is triggered during normal operation of affected audio hardware, specifically when using RME Fireface 800 interfaces with Linux kernels since version 5.14.0. The vulnerability is not exploitable remotely but occurs during regular system usage (Kernel Commit).

The issue has been resolved by reverting the problematic commit and restoring the process context work queue. The fix prevents the deadlock by ensuring proper lock handling between the audio subsystem components. Users should update to the patched kernel versions that include this fix (Kernel Commit).