Executive brief
A vulnerability in the Linux kernel's AMD audio driver could allow a local user to cause a system crash. The issue stems from how the system handles audio hardware initialization, specifically failing to verify that certain internal components are ready before using them. This could lead to a denial-of-service, impacting system stability and availability.
Technical details
A NULL pointer dereference (CWE-476) exists in the AMD ACP machine driver (sound/soc/amd/acp/acp-mach-common.c) within the Linux kernel. The functions acp_card_rt5682_init() and acp_card_rt5682s_init() failed to validate the return value of clk_get() before passing the resulting pointers to clock core functions. If clock acquisition fails, the driver dereferences an invalid pointer, resulting in a kernel oops/panic. The vulnerability is triggered during audio card initialization. It has been patched by migrating to devm_clk_get() and implementing proper IS_ERR() checks.
Affected products
- Linux Linux Kernel 5.16 to 6.19.9
Timeline
- 2026-03-10: other: Patch authored
- 2026-05-08: disclosed: CVE published
- 2026-05-21: advisory: NVD analysis completed