CVE-2024-42088
In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8195: Add platform entry for ETDM1_OUT_BE dai link Commit e70b8dd26711 ("ASoC: mediatek: mt8195: Remove afe-d...
Affects 1 product across 1 vendor.
Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.
A vulnerability in the Linux kernel's ASoC (Advanced SoC) subsystem for the Mediatek mt8195 platform could potentially allow unauthorized access or manipulation of audio data due to an incorrect removal of a codec entry for the ETDM1_OUT_BE dai link.
BSID: BS-2024-GLOBAL-203206-H • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: MEDIUM
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2024-42088?
What is the CVSS score for CVE-2024-42088?
Is CVE-2024-42088 actively exploited?
How do I remediate CVE-2024-42088?
What systems are affected by CVE-2024-42088?
| CVE ID | CVE-2024-42088 |
|---|---|
| BSID | BS-2024-GLOBAL-203206-H BreachSpider Global ID |
| CVSS Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| Published | 2024-07-29 |
| Last Modified | 2025-09-25 |
| ICS Relevance | 0% |
| Weakness (CWE) | |
| Source | NVD |
In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8195: Add platform entry for ETDM1_OUT_BE dai link Commit e70b8dd26711 ("ASoC: mediatek: mt8195: Remove afe-dai component and rework codec link") removed the codec entry for the ETDM1_OUT_BE dai link entirely instead of replacing it with COMP_EMPTY(). This worked by accident as the remaining COMP_EMPTY() platform entry became the codec entry, and the platform entry became completely empty, effectively the same as COMP_DUMMY() since snd_soc_fill_dummy_dai() doesn't do anything for platform entries. This causes a KASAN out-of-bounds warning in mtk_soundcard_common_probe() in sound/soc/mediatek/common/mtk-soundcard-driver.c: for_each_card_prelinks(card, i, dai_link) { if (adsp_node && !strncmp(dai_link->name, "AFE_SOF", strlen("AFE_SOF"))) dai_link->platforms->of_node = adsp_node; else if (!dai_link->platforms->name && !dai_link->platforms->of_node) dai_link->platforms->of_node = platform_node; } where the code expects the platforms array to have space for at least one entry. Add an COMP_EMPTY() entry so that dai_link->platforms has space.
Source: NIST NVD / MITRE CVE Database
An attacker with physical access to the device or the ability to execute code on the device could exploit this vulnerability to manipulate audio data streams, potentially leading to eavesdropping or data corruption.
Exploitation Likelihood: MEDIUM
| Vendor | Product | Affected Versions |
|---|---|---|
| Linux | Linux Kernel | 6.10 ≥ 6.8, < 6.9.8 |
No official vendor advisory link on record. See the CVE record →
| CISA known-exploited | Not in KEV catalog |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
AI Enrichment Record — provenance & audit hash
| Model | /workspace/models/qwen2.5-coder-32b-instruct-bf16 |
|---|---|
| Confidence | MEDIUM |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | d3490d50e560e0d2774951e7df37984487659a6d57c557b55bc30d302d373f6306b000ed2d98f9e8503ec118fbbd2b6f0e54f37e10fb4292a6fd486188b0467f |
ICS/OT Vulnerability Intelligence for Your Environment
BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.
Create a free account →