CVE-2023-54096

Vulnerability

Description

The soundwire subsystem in the Linux kernel uses two completion structures to allow drivers to wait for soundwire devices to become enumerated on the bus and initialized by their drivers. The signaling implementation is flawed: it does not wake all current and future waiters, and it reinitializes the completion with the wrong function, which can cause memory corruption if waiters are still on the queue [1][2][3][4].

Exploitation

This bug affects driver synchronization. Not properly signaling future waiters breaks sound card probe deferral because codec drivers cannot determine that the soundwire device is already attached when being reprobed. Similarly, codec runtime PM implementations can time out waiting for enumeration during resume, even if the device was already enumerated [1][2][3][4].

Impact

An attacker with local access could potentially trigger the memory corruption by manipulating driver loading sequences, leading to system instability or denial of service. The incorrect completion signaling may also cause permanent driver probe failures, making sound hardware unavailable. However, there is no evidence of remote exploitation.

Mitigation

The issue is fixed in Linux kernel stable commits [1][2][3][4]. Users should apply the relevant kernel patches to ensure soundwire completions are correctly signaled. No workaround is available beyond updating the kernel.