Executive brief
A vulnerability in the Linux kernel's audio driver for FireWire devices could allow a local user to cause a system crash. The issue occurs when the system processes status messages from a connected hardware device without properly verifying the data. This could lead to a denial-of-service, impacting the availability of the affected system.
Technical details
An out-of-bounds read vulnerability exists in the ALSA fireworks driver (sound/firewire/fireworks/fireworks_command.c) within the Linux kernel. The 'efw_transaction' function uses a 32-bit status field supplied by a FireWire device as an index into the 'efr_status_names' array without proper bounds checking. Since the array only contains 17 entries, a malicious or malfunctioning device providing a large status value (such as EFR_STATUS_INCOMPLETE at 0x80000000) causes the kernel to access memory outside the array's bounds when formatting error messages. This can lead to a kernel oops or system instability. The fix implements proper bounds checking against ARRAY_SIZE(efr_status_names) and defaults to an 'unknown' string for unrecognized values.
Affected products
- Linux Linux Kernel 3.16 to 6.6.136, 6.7 to 6.12.83, 6.13 to 6.18.24, 6.19 to 6.19.14, 7.0 to 7.0.1
Timeline
- 2026-04-24: disclosed
- 2026-04-24: advisory
- 2026-04-09: patched: Initial patch authored by Greg Kroah-Hartman
References
- https://git.kernel.org/stable/c/07704bbf36f57e4379e4cadf96410dab14621e3b
- https://git.kernel.org/stable/c/183aa0de0f680496b9feb85c9d182681ad4600dd
- https://git.kernel.org/stable/c/327f8e730e3c65ec97df9d3b07de66aeb3dc932d
- https://git.kernel.org/stable/c/62fcb273fbee5b2a0e7ed41cc914c8d7d1a5d285
- https://git.kernel.org/stable/c/67cfd14074cdafab5de3f7cfc0952c1a9b653e5d
- https://git.kernel.org/stable/c/682d8accf0d83a871e8c327b95c81f53902c922b
- https://git.kernel.org/stable/c/cc624b3d2be13297100539b64ad950695188e046