CVE-2026-12232: Out-of-bounds read via unvalidated stream_id in Intel ALH DAI get_properties
The Intel ALH digital-audio-interface driver function daialhgetproperties() in drivers/dai/intel/alh/alh.c used a caller-supplied int streamid with no range validation. The value indexes the fixed-size static const uint8t alhhandshakemap[64] array and scales a FIFO register address, so an out-of-range streamid produces an out-of-bounds read of one byte at an attacker-chosen signed offset from the array. That byte is written into prop->dmahsid and the resulting struct daiproperties is copied back to the caller, leaking it.
daigetpropertiescopy() is a Zephyr syscall, and its verifier zvrfydaigetpropertiescopy() (drivers/dai/daihandlers.c) validates only the device-object permission and the destination buffer, not streamid. A user-mode thread that has been granted access to the ALH DAI device object can therefore call the syscall with an arbitrary streamid, crossing the userspace/kernel sandbox boundary.
The impact is a one-byte-per-call arbitrary-offset kernel information disclosure (and leakage of a computed kernel address via fifoaddress); a streamid that resolves to an unmapped page faults in kernel context, giving a local denial of service. Exploitation requires CONFIGUSERSPACE and device access, making this a local, moderate-severity issue. The fix rejects negative and too-large streamid values up front and returns NULL, which the copy wrapper maps to -ENOENT.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update/patch dai_alh_get_properties() so it validates caller-supplied stream_id: return NULL immediately when stream_id is negative or exceeds the valid range (so dai_get_properties_copy() maps this to -ENOENT instead of performing an out-of-bounds access to alh_handshake_map[64]).
Intel ALH DAI driver (drivers/dai/intel/alh/alh.c) stream_id validation in dai_alh_get_properties() = Reject negative and too-large stream_id values; return NULL for invalid stream_id (prop copy maps NULL to -ENOENT) - Configuration
Modify z_vrfy_dai_get_properties_copy() to validate stream_id range (including rejecting negative values) before allowing the syscall, since the current verifier only checks device-object permission and destination buffer.
Zephyr syscall verifier (drivers/dai/dai_handlers.c) for dai_get_properties_copy() z_vrfy_dai_get_properties_copy() stream_id checks = Validate stream_id range in the verifier (not just device permission and destination buffer) - Compensating control
Reduce exposure by limiting CONFIG_USERSPACE and restricting user-mode access to the ALH DAI device object, since exploitation requires CONFIG_USERSPACE and device access (userspace/kernel sandbox boundary crossing via the granted device-object permission).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12232?
The severity of CVE-2026-12232 is medium with a score of 6.1.
What is CVE-2026-12232 related to?
CVE-2026-12232 is related to an out-of-bounds read in the Intel ALH digital-audio-interface driver.
How do I fix CVE-2026-12232?
To fix CVE-2026-12232, ensure that the stream_id passed to the dai_alh_get_properties() function includes proper range validation.
What causes the vulnerability in CVE-2026-12232?
The vulnerability in CVE-2026-12232 is caused by the lack of range validation for the caller-supplied int stream_id.
What are the potential impacts of CVE-2026-12232?
The potential impacts of CVE-2026-12232 include denial-of-service due to the out-of-bounds read.