CVE-2024-26799

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The only way to invoke `lpass_cdc_dma_daiops_trigger()` is an `SNDRV_PCM_IOCTL_DROP`/`PAUSE` ioctl on a local `/dev/snd/pcmC*D*` node, routed through `soc_pcm_trigger()` → `snd_soc_pcm_dai_trigger()`. No packet, adjacent-network, or physical path reaches this DAI operation.

AC:HAttack complexity, high

The uninitialized `dmactl` is only consumed when `__lpass_get_dmactl_handle()` falls to its `default:` arm, which requires `cpu_dai->driver->id` to lie outside `LPASS_CDC_DMA_RX0…VA_TX8`; that id is a compile-time constant in the DAI table and the sole in-tree consumer (`lpass-sc7280.c`: ids 6, 19, 25) is fully covered. The attacker cannot influence which DAI table the kernel was built with, which is CVSS's "conditions beyond the attacker's control."

PR:LPrivileges required, low

Reaching the trigger op needs only an open PCM substream on a `root:audio` 0660 device node — no `capable()`, `CAP_SYS_ADMIN`, or any other check exists along `snd_pcm_ioctl` → `soc_pcm_trigger` → the DAI callback. A local unprivileged account with routine audio access (default for desktop and Chromebook sessions on this SoC) suffices.

UI:NUser interaction, none

The attacker opens the PCM device and issues the DROP/PAUSE ioctls entirely from their own process. No victim needs to play audio, mount anything, or take any action.

S:UScope, unchanged

The garbage pointer is dereferenced by kernel code operating on the kernel's own LPASS regmap, and all consequences stay within the kernel's security authority. No hypervisor, IOMMU, or sandbox boundary is crossed.

C:HConfidentiality impact, high

When the branch is taken, `dmactl` holds residual kernel-stack data that an attacker can prime via a preceding syscall at the same stack depth, and `dmactl->codec_enable` is then loaded as a `struct reg_field *` — an attacker-influenced read of arbitrary kernel memory feeding subsequent regmap state. Per the round-up rule this uncontrolled-pointer read is scored High rather than as a bounded leak.

I:HIntegrity impact, high

`regmap_fields_write(dmactl->codec_enable, id, LPAIF_DMACTL_ENABLE_OFF)` performs a write through a field descriptor obtained from the wild pointer, with `id` also left uninitialized as the field index, yielding writes to attacker-influenced register/memory locations. That is a memory-corruption primitive usable toward control-flow hijack, not a bounded modification.

A:HAvailability impact, high

Dereferencing an uninitialized stack pointer that survives the `if (!dmactl)` guard produces an immediate oops in `regmap_fields_write()`, and a bad regmap field index can additionally program the LPASS DMA control block into an invalid state. Any such kernel oops or wedged audio DMA engine is a full availability loss.