{"id":"CVE-2026-12232","title":"Out-of-bounds read via unvalidated stream_id in Intel ALH DAI get_properties","summary":"The Intel ALH digital-audio-interface driver function dai_alh_get_properties() in drivers/dai/intel/alh/alh.c used a caller-supplied int stream_id with no range validation. The value indexes the fixed-size static const uint8_t alh_handsh…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","cvssSource":"cna","cwe":["CWE-125"],"vendor":"zephyrproject","product":"zephyr","affected":["zephyr >= 4.4.0 < 4.5.0"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-08-13T15:09:10.805870Z"},"published":"2026-08-12","updated":"2026-11-04","sourceUpdated":"2026-11-04T04:59:23.715Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-12232","references":[{"url":"https://github.com/zephyrproject-rtos/zephyr/commit/b470bfce689809621cc5cd8c04a4eca93795827a","label":"Fix commit"},{"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-3557-j848-pv24","label":"GHSA-3557-j848-pv24"}],"tags":["cve.org"],"epss":0.00148,"epssPercentile":0.04064,"ingestedAt":"2026-11-05T20:33:06.700Z","slug":"CVE-2026-12232","body":"## Overview\n\nThe Intel ALH digital-audio-interface driver function dai_alh_get_properties() in drivers/dai/intel/alh/alh.c used a caller-supplied int stream_id with no range validation. The value indexes the fixed-size static const uint8_t alh_handshake_map[64] array and scales a FIFO register address, so an out-of-range stream_id produces an out-of-bounds read of one byte at an attacker-chosen signed offset from the array. That byte is written into prop->dma_hs_id and the resulting struct dai_properties is copied back to the caller, leaking it.\n\ndai_get_properties_copy() is a Zephyr __syscall, and its verifier z_vrfy_dai_get_properties_copy() (drivers/dai/dai_handlers.c) validates only the device-object permission and the destination buffer, not stream_id. A user-mode thread that has been granted access to the ALH DAI device object can therefore call the syscall with an arbitrary stream_id, crossing the userspace/kernel sandbox boundary.\n\nThe impact is a one-byte-per-call arbitrary-offset kernel information disclosure (and leakage of a computed kernel address via fifo_address); a stream_id that resolves to an unmapped page faults in kernel context, giving a local denial of service. Exploitation requires CONFIG_USERSPACE and device access, making this a local, moderate-severity issue. The fix rejects negative and too-large stream_id values up front and returns NULL, which the copy wrapper maps to -ENOENT.\n\n## Affected\n\n- `zephyr >= 4.4.0 < 4.5.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}