Executive brief
The Linux kernel's HDAC HDMI audio codec driver contained a flaw where an invalid audio configuration value could cause the driver to read past the end of an internal array. This could allow a privileged user with control over audio settings to trigger a kernel information leak or crash.
Technical details
The vulnerability is an out-of-bounds array read in the hdac_hdmi_set_pin_port_mux() function within the ASoC HDMI codec driver (sound/soc/codecs/hdac_hdmi.c). The function used a user-supplied enum value to index into a texts array before validating the value through snd_soc_dapm_put_enum_double(). An out-of-range enumerated value could cause the driver to read past the texts array bounds. The fix reorders operations to validate the enum value via the helper function before performing the array lookup, ensuring only valid indices are used. The vulnerability requires local access to audio control interfaces and is fixed in patched kernel versions.
Affected products
- Linux Linux kernel multiple versions before patch commit 0b08baeccdcf52fad328ad645f5b4fbee04eea34
Timeline
- 2026-08-15: disclosed
- 2026-06-11: patched: Patch committed upstream
- 2026-07-24: other: Patch added to stable trees