Executive brief
A vulnerability was identified in the Linux kernel's audio driver for certain AMD platforms. The software failed to verify if it successfully acquired necessary system timing components (clocks) before using them. This could lead to a system crash or unpredictable behavior when the audio hardware is initialized.
Technical details
A vulnerability exists in the acp3x_5682_init() function within the sound/soc/amd/acp3x-rt5682-max9836.c driver. The code failed to validate the return value of clk_get() for 'rt5682-dai-wclk' and 'rt5682-dai-bclk'. If these clock acquisitions fail, the driver would proceed to dereference error pointers in rt5682_clk_enable(), leading to a kernel oops or crash. The fix involves migrating to devm_clk_get() and implementing proper IS_ERR() validation. This is a local denial-of-service vector requiring the ability to trigger audio hardware initialization.
Affected products
- Linux Linux Kernel 6b8e4e7db3cd to 53f3a900e9a383d47af7253076e19f510c5708d0
Timeline
- 2026-03-10: other: Patch submitted by developer
- 2026-05-13: disclosed: CVE published
References
- https://git.kernel.org/stable/c/092522621901b5e6af61db04a53f5b313903c6d0
- https://git.kernel.org/stable/c/2b0c4a399c8d27f20ecf17dda76751141d6dbb59
- https://git.kernel.org/stable/c/2dc43ac8da7b2bebc5a51a3d86a6275d78f27cff
- https://git.kernel.org/stable/c/33de168afdd57265a0e0c20dbd3648a2d8f7cdc4
- https://git.kernel.org/stable/c/35c7624d30cb45ec336cd16ce072acc32ae351cb
- https://git.kernel.org/stable/c/4d802f23fcbfec05134653fd001f6c7c3fd55196
- https://git.kernel.org/stable/c/53f3a900e9a383d47af7253076e19f510c5708d0