Executive brief
A vulnerability was identified in the Linux kernel's Apple Onboard Audio (AOA) driver. Under specific low-memory conditions, the system could experience a crash (kernel panic) when attempting to initialize audio components. This issue primarily affects the stability and availability of systems using this specific audio hardware driver.
Technical details
A NULL pointer dereference vulnerability exists in the Linux kernel's ALSA (Advanced Linux Sound Architecture) subsystem, specifically within the Apple Onboard Audio (aoa) fabric driver. The function `layout_attached_codec` in `sound/aoa/fabrics/layout.c` calls `snd_ctl_new1()` to allocate new control structures but fails to validate the return value. If memory allocation fails, the function continues to dereference the resulting NULL pointer when accessing `ctl->id.name` or passing it to `aoa_snd_ctl_add()`. This can be triggered during codec attachment, leading to a kernel oops or panic. Patches have been released across multiple stable kernel branches to add the necessary NULL checks.
Affected products
- Linux Linux Kernel 2.6.18 to 6.6.145
Timeline
- 2026-05-27: other: Initial patch authored
- 2026-07-24: patched: Patches committed to stable branches
- 2026-07-25: disclosed: CVE published
References
- https://git.kernel.org/stable/c/2ee9c46fd2dcd529cef18e37636ee12f5c3dbedd
- https://git.kernel.org/stable/c/8df560fefe6fed6a20b7e06720eeaeccec349ac0
- https://git.kernel.org/stable/c/b0154ebc6dc552c389a574b1e221d728e10346e7
- https://git.kernel.org/stable/c/d62624fe256b2d0d13454c78cbfc70ff5d954dc7
- https://git.kernel.org/stable/c/d73067e2bbf3775a495d9f38e38d0a3cf53ee790
- https://git.kernel.org/stable/c/e47f2a341adbac001b6f5d0211b0cd1c1668637b
- https://git.kernel.org/stable/c/e5e8c4508d95af82f9b4d065f658e5476a8e9bc8