Executive brief
A vulnerability was identified in the Linux kernel's ALSA sound subsystem, specifically within the AudioScience ASIHPI driver. This driver is used to manage professional multi-channel audio hardware. An issue in how the driver reads cached information could allow an attacker to trigger an out-of-bounds memory access, potentially leading to a system crash or unauthorized access to sensitive kernel memory.
Technical details
A vulnerability exists in the Linux kernel's ALSA (Advanced Linux Sound Architecture) subsystem within the asihpi driver. The function 'find_control()' in 'sound/pci/asihpi/hpicmn.c' fails to validate the 'control_index' parameter before using it to access the 'p_cache->p_info' array. A local attacker could provide an out-of-bounds index, leading to an out-of-bounds (OOB) memory access. This could result in a kernel oops, denial of service, or potential information leakage from kernel memory. The issue has been resolved by adding a sanity check to ensure the index is within the 'control_count' bounds. Fixes are available in various stable kernel branches including 5.10.258, 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, and 7.0.11.
Affected products
- Linux Linux Kernel 5.10.258, 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11
Timeline
- 2026-05-15: other: Initial patch authored by Takashi Iwai
- 2026-07-19: disclosed: CVE published to NVD dataset
References
- https://git.kernel.org/stable/c/34d0d492a2812b9289af14bca3573a89275965b2
- https://git.kernel.org/stable/c/61c5017c64e2ac9e10b70b14b17a079dbc0a805f
- https://git.kernel.org/stable/c/7b6f8c8eb93f02a74b1de8e521c0952af10d1f43
- https://git.kernel.org/stable/c/7b7d6572145c1dab2dd9bfb550b188e5f0ff3c3f
- https://git.kernel.org/stable/c/7d107239935793995bdc6cf29bb99e180bde4c28
- https://git.kernel.org/stable/c/8778386e4387b28f2bf8425d7ffc667c6294457f
- https://git.kernel.org/stable/c/e060e21fe9cca1e5eafd8a1c597026577771e8d9