The hdac_hdmi_set_pin_port_mux() function in the ASoC hdac_hdmi driver indexes an internal texts array using a value supplied by user input before that value is validated by snd_soc_dapm_put_enum_double(). An out‑of‑range enum value can therefore cause the driver to read past the end of the array the helper rejects the write. This results in an out‑of‑bounds read in kernel space, which can expose kernel memory contents. The vulnerability does not directly enable code execution, but the leaked data could aid in further attacks.

All Linux kernel versions containing the ASoC hdac_hdmi driver prior to the patch commit that moved the array lookup after validation are affected. The fix was added in a recent kernel update; any release older than that is vulnerable.

The CVSS score of 7.1 indicates a moderate severity level. The EPSS score of less than 1% suggests that exploitation of this flaw is unlikely to be seen in the wild. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a local user or any process able to write to the hdac_hdmi driver, as that is required to supply the out‑of‑range enum value. No public exploit is currently known. The impact is limited to kernel memory disclosure and could serve as a foothold for further attacks if additional vulnerabilities are present.