Description
The Intel ALH digital-audio-interface driver function dai_alh_get_properties() in drivers/dai/intel/alh/alh.c used a caller-supplied int stream_id with no range validation. The value indexes the fixed-size static const uint8_t alh_handshake_map[64] array and scales a FIFO register address, so an out-of-range stream_id produces an out-of-bounds read of one byte at an attacker-chosen signed offset from the array. That byte is written into prop->dma_hs_id and the resulting struct dai_properties is copied back to the caller, leaking it.

dai_get_properties_copy() is a Zephyr __syscall, and its verifier z_vrfy_dai_get_properties_copy() (drivers/dai/dai_handlers.c) validates only the device-object permission and the destination buffer, not stream_id. A user-mode thread that has been granted access to the ALH DAI device object can therefore call the syscall with an arbitrary stream_id, crossing the userspace/kernel sandbox boundary.

The impact is a one-byte-per-call arbitrary-offset kernel information disclosure (and leakage of a computed kernel address via fifo_address); a stream_id that resolves to an unmapped page faults in kernel context, giving a local denial of service. Exploitation requires CONFIG_USERSPACE and device access, making this a local, moderate-severity issue. The fix rejects negative and too-large stream_id values up front and returns NULL, which the copy wrapper maps to -ENOENT.
Published: 2026-08-12
Score: 6.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability arises when the Intel ALH DAI driver in Zephyr does not validate the caller supplied stream_id used to index a 64‑element array. An out‑of‑range value causes an out‑of‑bounds read of one byte, which is then returned to the caller via the dai_properties structure. A negative or excessively large stream_id can read a byte from an attacker chosen signed offset in the kernel or, if the offset points to an unmapped page, trigger a fault that causes local denial of service. This flaw is an instance of CWE‑125, out‑of‑bounds read.

Affected Systems

The flaw exists in the zephyrproject:zephyr product, specifically within the drivers/dai/intel/alh directory of the Zephyr RTOS. All builds that include this driver and have CONFIG_USERSPACE enabled are potentially affected, though the advisory does not list exact version numbers that contain the issue.

Risk and Exploitability

The local risk is moderate, reflected by a CVSS score of 6.1. No EPSS data is available and the vulnerability is not referenced in CISA KEV. An attacker only needs to run a user‑space thread with permission to the ALH DAI device object; such a thread can call the restricted syscall with an arbitrary stream_id to read a byte of kernel memory or cause a crash. The CVE fix rejects negative and oversized stream_id values at the source, returning an error code that prevents the disclosure and crash vectors.

Generated by OpenCVE AI on August 12, 2026 at 12:49 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Zephyr to a version that includes the fix rejecting invalid stream_id values.
  • When a patch is unavailable, limit access to the ALH DAI device to only trusted user threads or disable the device in the ZEPHYR config if it is not required for the application.
  • If rapid remediation is not possible, consider disabling CONFIG_USERSPACE or the Intel ALH DAI driver to reduce the attack surface.

Generated by OpenCVE AI on August 12, 2026 at 12:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 12 Aug 2026 04:30:00 +0000

Type Values Removed Values Added
Description The Intel ALH digital-audio-interface driver function dai_alh_get_properties() in drivers/dai/intel/alh/alh.c used a caller-supplied int stream_id with no range validation. The value indexes the fixed-size static const uint8_t alh_handshake_map[64] array and scales a FIFO register address, so an out-of-range stream_id produces an out-of-bounds read of one byte at an attacker-chosen signed offset from the array. That byte is written into prop->dma_hs_id and the resulting struct dai_properties is copied back to the caller, leaking it. dai_get_properties_copy() is a Zephyr __syscall, and its verifier z_vrfy_dai_get_properties_copy() (drivers/dai/dai_handlers.c) validates only the device-object permission and the destination buffer, not stream_id. A user-mode thread that has been granted access to the ALH DAI device object can therefore call the syscall with an arbitrary stream_id, crossing the userspace/kernel sandbox boundary. The impact is a one-byte-per-call arbitrary-offset kernel information disclosure (and leakage of a computed kernel address via fifo_address); a stream_id that resolves to an unmapped page faults in kernel context, giving a local denial of service. Exploitation requires CONFIG_USERSPACE and device access, making this a local, moderate-severity issue. The fix rejects negative and too-large stream_id values up front and returns NULL, which the copy wrapper maps to -ENOENT.
Title Out-of-bounds read via unvalidated stream_id in Intel ALH DAI get_properties
Weaknesses CWE-125
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: zephyr

Published:

Updated: 2026-08-12T03:34:14.145Z

Reserved: 2026-06-15T01:56:01.607Z

Link: CVE-2026-12232

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-12T05:17:41.860

Modified: 2026-08-12T05:17:41.860

Link: CVE-2026-12232

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-12T13:00:03Z

Weaknesses