Executive brief
The Linux kernel's AMD audio codec driver contains a buffer over-read flaw in its SoundWire sound card initialization code. When the driver processes audio device endpoints, it can read past the end of an allocated array, potentially causing a kernel crash or unexpected behavior during audio hardware initialization on AMD systems with SoundWire audio codecs.
Technical details
The vulnerability is a buffer over-read (slab-out-of-bounds) in the create_sdw_dailinks() function within sound/soc/amd/acp/acp-sdw-legacy-mach.c. The function iterates through a dynamically allocated array of DAI links (soc_dais) looking for an uninitialized entry marker, but lacks bounds checking when the array size (num_ends) is not passed to the function. If all entries in the array are initialized, the loop reads past the allocated buffer. The flaw was exposed by KASAN (Kernel Address Sanitizer) reporting an out-of-bounds read. The fix adds the array size as a function parameter and converts the unbounded while loop to a bounded for loop that checks both the count and initialization status. This is a local, kernel-space vulnerability with limited direct exploitation impact.
Affected products
- Linux Linux kernel 5.0 and later (specifically affecting AMD ACP SoundWire legacy stack)
Timeline
- 2026-08-15: disclosed: CVE-2026-74333 published
- 2026-05-28: patched: Fix committed upstream by Aaron Ma
- 2026-07-24: patched: Fix included in stable kernel releases