Executive brief
The Linux kernel's audio driver for Cirrus Logic CS35L41 speaker amplifiers contains a NULL pointer dereference bug in the mute state detection logic. If the kernel fails to retrieve mute information from system firmware, it will crash instead of handling the error gracefully. This can cause systems with affected audio hardware to become unstable or unresponsive.
Technical details
The vulnerability is a NULL pointer dereference in the cs35l41_get_acpi_mute_state() function within the ALSA HDA audio subsystem. The acpi_evaluate_dsm() function is called to retrieve mute state information from ACPI firmware, but the returned pointer is dereferenced without checking if it is NULL. The acpi_evaluate_dsm() function can legitimately return NULL when acpi_evaluate_object() fails, but the code does not account for this case. The fix adds a NULL pointer check after the function call and returns -EINVAL if the pointer is NULL. The vulnerability was discovered via static analysis using SVACE and affects systems with CS35L41 speaker amplifiers that use the HDA audio driver.
Affected products
- Linux Linux kernel various versions prior to patching; affects ALSA HDA subsystem with CS35L41 mute notification support
Timeline
- 2025-10-30: disclosed
- 2025-10-11: patched: Upstream fix committed by Takashi Iwai