Executive brief
A vulnerability was identified in the Linux kernel's audio driver for the Realtek RT1011 codec. An internal programming error could cause the system to attempt to access an invalid memory address when changing speaker mode settings. This could lead to a system crash or instability, potentially impacting the availability of devices using this specific audio hardware.
Technical details
A NULL pointer dereference vulnerability exists in the rt1011_recv_spk_mode_put() function within sound/soc/codecs/rt1011.c. The issue stems from using the incorrect helper function snd_soc_dapm_kcontrol_to_dapm() to retrieve the DAPM (Dynamic Audio Power Management) context from a kcontrol, which returns NULL in this specific implementation. An attacker with local access to audio controls could trigger this dereference, leading to a kernel oops or system crash. The fix replaces the incorrect helper with snd_soc_component_to_dapm() to properly retrieve the context from the component structure.
Affected products
- Linux Linux Kernel rt1011 codec driver
Timeline
- 2026-03-10: patched: Initial patch submitted to the Linux kernel tree
- 2026-05-13: disclosed: CVE published by kernel.org