{"cve":"CVE-2024-26799","nvd":{"published":"2024-04-04T09:15:08.953","modified":"2026-10-30T13:17:21.817","status":"Modified","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: qcom: Fix uninitialized pointer dmactl\n\nIn the case where __lpass_get_dmactl_handle is called and the driver\nid dai_id is invalid the pointer dmactl is not being assigned a value,\nand dmactl contains a garbage value since it has not been initialized\nand so the null check may not work. Fix this to initialize dmactl to\nNULL. One could argue that modern compilers will set this to zero, but\nit is useful to keep this initialized as per the same way in functions\n__lpass_platform_codec_intf_init and lpass_cdc_dma_daiops_hw_params.\n\nCleans up clang scan build warning:\nsound/soc/qcom/lpass-cdc-dma.c:275:7: warning: Branch condition\nevaluates to a garbage value [core.uninitialized.Branch]","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.0},"cwes":["CWE-824"],"references":["https://git.kernel.org/stable/c/1382d8b55129875b2e07c4d2a7ebc790183769ee","https://git.kernel.org/stable/c/3301f5513e668d47514f32b0fea39e85b1152010","https://git.kernel.org/stable/c/99adc8b4d2f38bf0d06483ec845bc48f60c3f8cf","https://git.kernel.org/stable/c/d5a7726e6ea62d447b79ab5baeb537ea6bdb225b","https://git.kernel.org/stable/c/1382d8b55129875b2e07c4d2a7ebc790183769ee"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-30T13:47:47.119061695+00:00"},"epss":{"cve":"CVE-2024-26799","score":0.00241,"percentile":0.15248,"date":"2026-10-30"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}