CVE-2024-46798: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-46798 is a use-after-free vulnerability discovered in the Linux kernel's ASoC (ALSA System on Chip) DAPM (Dynamic Audio Power Management) subsystem. The vulnerability was identified when snd_pcm_suspend_all() accessed a freed 'snd_soc_pcm_runtime' object during system suspension (Kernel Git).

The vulnerability was discovered when using specific kernel configurations including CONFIG_KASAN=y, CONFIG_KASAN_GENERIC=y, CONFIG_KASAN_INLINE=y, CONFIG_KASAN_VMALLOC=y, and CONFIG_FRAME_WARN=4096. The issue occurs in the snd_pcm_suspend_all() function, which attempts to access a freed snd_soc_pcm_runtime object, leading to a use-after-free condition. The bug was detected by the Kernel Address Sanitizer (KASAN) during system suspension (Kernel Git).

When exploited, this vulnerability could lead to a use-after-free condition in the Linux kernel's audio subsystem during system suspension. This could potentially result in system instability or crashes when the affected code path is triggered (NVD).

The vulnerability is triggered during system suspension when the snd_pcm_suspend_all() function is called. The issue specifically occurs in the context of the systemd-sleep process, as evidenced by the kernel trace logs (Kernel Git).

A fix has been implemented that ensures substream->runtime is set to NULL after being freed. This patch has been merged into the Linux kernel mainline and is being backported to stable kernel versions. The fix addresses the root cause by properly handling the pointer after memory deallocation (Kernel Git).