DEBIAN-CVE-2024-38618
In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Set lower bound of start tick time Currently ALSA timer doesn't have the lower limit of the start tick time, and it allows a very small size, e.g. 1 tick with 1ns resolution for hrtimer. Such a situation may lead to an unexpected RCU stall, where the callback repeatedly queuing the expire update, as reported by fuzzer. This patch introduces a sanity check of the timer start tick time, so that the system returns an error when a too small start size is set. As of this patch, the lower limit is hard-coded to 100us, which is small enough but can still work somehow.
Risk Scores
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Debian:12 | linux | 6.1.76-1, 6.1.90-1, 6.1.94-1 |
| Debian:13 | linux | 0, 0 |
| Debian:11 | linux | 5.10.92-2, 5.10.84-1, 5.10.106-1 |
| Debian:14 | linux | 0, 0 |
Timeline
- Jun 19, 2024 CVE Published
- Apr 28, 2026 CVE Updated