Executive brief
A vulnerability in the Linux kernel's sound subsystem (ALSA) could allow a local user to cause a system crash. The issue occurs when the system processes certain audio control names, leading to a kernel panic. This primarily impacts system availability, potentially allowing a local attacker to disrupt operations or cause a denial of service.
Technical details
A vulnerability exists in the Linux kernel ALSA (Advanced Linux Sound Architecture) control interface within the snd_ctl_elem_init_enum_names() function. The function iterates through a buffer of names while decrementing the remaining buffer length (buf_len). If buf_len reaches zero while items still remain in the loop, the code calls strnlen(p, 0). When the kernel is compiled with CONFIG_FORTIFY_SOURCE and using Clang, the fortified strnlen() implementation may trigger a BRK exception panic because the compiler loses track of the object size of the pointer 'p'. This results in a local denial of service (kernel panic). The fix introduces a guard to validate buf_len before the strnlen() call.
Affected products
- Linux Linux Kernel Fixed in versions 1fbe46d, 654c818, 82012fd, 8ba0214, e0da8a8
Timeline
- 2026-04-14: disclosed: Vulnerability identified and patch submitted by Xiaomi engineers.
- 2026-05-27: advisory: CVE-2026-46088 published.
References
- https://git.kernel.org/stable/c/1fbe46d2b72754d8bd580e13e59ccb5d3d0e8cb0
- https://git.kernel.org/stable/c/654c818a69c21d2bea4e8fd9eae7da865df9a5c8
- https://git.kernel.org/stable/c/82012fd3e78a14360fbc2f1a7491589896704f97
- https://git.kernel.org/stable/c/8ba0214c3dd32b8ec652947e3f2bc5b8f6e6be9e
- https://git.kernel.org/stable/c/e0da8a8cac74f4b9f577979d131f0d2b88a84487