Executive brief
A vulnerability in the Linux kernel's audio subsystem could allow a local user to crash the system. The issue occurs when there is a configuration mismatch in the audio hardware drivers, specifically affecting Intel High Definition Audio (HDA) components. This could lead to a system-wide denial of service, impacting operational availability.
Technical details
A NULL pointer dereference exists in the sound/soc/sof/intel/hda-dai.c component of the Linux kernel. The vulnerability is triggered in hda_dai_get_ops() when a mismatch occurs between Digital Audio Interface (DAI) links in the machine driver and the system topology, particularly during loopback capture for echo references. If the playback or capture widget is not properly set, the kernel attempts to dereference a NULL pointer, resulting in a kernel oops/panic. This is a local attack vector requiring low privileges and no user interaction. Patches have been released across multiple stable kernel branches (e.g., 6.12.75, 6.18.16, 6.19.6).
Affected products
- Linux Linux Kernel 5.16 to 6.12.75, 6.13 to 6.18.16, 6.19 to 6.19.6
Timeline
- 2026-05-06: disclosed: Initial publication of the CVE record.
- 2026-05-06: advisory
- 2026-05-23: patched: NVD record updated with patch information.