Executive brief
The Linux kernel's audio subsystem (ASoC) for AMD processors contains a buffer overflow vulnerability in the SoundWire DAI link setup code. When all digital audio interface entries are initialized, the code reads past the end of an allocated array, potentially allowing an attacker to read sensitive kernel memory or cause a denial of service. This affects audio functionality on AMD-based systems.
Technical details
The vulnerability is a classic buffer over-read in the create_sdw_dailinks() function within the ASoC AMD ACP SoundWire machine driver. The function iterates through an array of sof_dais structures using a while loop that checks only the "initialised" flag but lacks bounds checking; if all array entries are initialized, the loop continues past the end of the allocated array. The root cause is the absence of an array size parameter passed to the iteration logic. The fix adds a num_dais parameter and replaces the unbounded while loop with a bounded for loop that enforces both array bounds and the initialisation flag check. No authentication or user interaction is required; the vulnerability can be triggered during kernel audio subsystem initialization on affected systems. A patch is available in the upstream Linux kernel.
Affected products
- Linux Linux kernel multiple versions with ASoC AMD ACP driver (approximately 5.x–6.x series based on fix dates)
Timeline
- 2026-08-15: disclosed: Published on NVD
- 2026-06-08: patched: Upstream patch merged by Mark Brown
- 2026-07-24: patched: Backported to stable kernel by Greg Kroah-Hartman