CVE-2023-54096

A moderate-impact flaw was found in the Linux kernel soundwire subsystem as shipped in Red Hat Enterprise Linux 8 and Red Hat Enterprise Linux 9. The signalling code in drivers/soundwire/bus.c that lets drivers wait for a soundwire device to become enumerated on the bus and initialised does not signal all current and future waiters, and it reinitialises the completion structures with the wrong function. If drivers are still waiting on the completion queue when the structure is reinitialised, kernel memory can be corrupted, affecting integrity and availability but not confidentiality (Red Hat CVSS 6.1, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H). The missing signalling also breaks sound card probe deferrals, because codec drivers cannot tell that a soundwire device is already attached when being reprobed, and can cause codec runtime PM resume paths to time out despite the device already being enumerated. Exploitation requires local access and specific timing of soundwire device enumeration, so practical exposure is limited to systems using soundwire-attached audio devices. Red Hat Enterprise Linux 6, 7, 8.2, 8.10, 9.4 and later, 10, and Red Hat In-Vehicle OS ship kernels in which the vulnerable code is not present and are therefore not affected. The affected RHEL 8 (8.4, 8.6, 8.8) and RHEL 9 (9.0, 9.2) kernel and kernel-rt z-streams have a deferred fix: because the flaw is rated moderate severity and triggering it requires local access and a narrow soundwire enumeration race, a fix is not currently scheduled for those older z-streams and may be considered in a future update. Until a fixed kernel is delivered on those streams, the residual risk is potential kernel memory corruption on systems using soundwire devices. The CVE.org severity of 7.8 (High) is higher than the Red Hat rating of moderate because Red Hat's scoring reflects no confidentiality impact and the constrained local conditions required to trigger the issue.