#VU99123 Infinite loop in Linux kernel - CVE-2024-50011


| Updated: 2025-05-12

Vulnerability identifier: #VU99123

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50011

CWE-ID: CWE-835

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the ARRAY_SIZE() function in sound/soc/intel/common/soc-acpi-intel-rpl-match.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: 6.11, 6.11.1, 6.11.2


External links
https://git.kernel.org/stable/c/aa3109ee91fe09e696274e6ac44813df8d13678f
https://git.kernel.org/stable/c/5afc29ba44fdd1bcbad4e07246c395d946301580
https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.11.3
https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.


Latest bulletins with this vulnerability