EUVD-2026-59439
GHSA-86v6-c9p3-rm2j
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Local ALSA control write access with audio group privileges required (PR:L, AV:L); OOB read leaks kernel memory (C:H) or crashes kernel (A:H); no integrity impact.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
ASoC: tegra: tegra210_ahub: Validate written enum value
tegra_ahub_put_value_enum() reads e->values[item[0]] before checking whether item[0] is within the enum item range. The existing check therefore happens too late to prevent an out-of-range read of the values array.
Move the check before the array access.
AnalysisAI
Out-of-bounds array read in the Linux kernel's ASoC Tegra audio driver (tegra210_ahub) allows a local attacker with low privileges to disclose kernel memory contents or trigger a kernel panic on NVIDIA Tegra 210-based systems. The flaw in tegra_ahub_put_value_enum() accesses e->values[item[0]] before validating that item[0] falls within the valid enum range, making the existing bounds check ineffective. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local shell access on a Linux system equipped with an NVIDIA Tegra 210 SoC and the tegra210_ahub kernel module actively loaded. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) correctly reflects a locally exploitable flaw requiring only low-privilege access, with no user interaction, and carrying high confidentiality and availability impacts. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local attacker with a standard unprivileged account on a Tegra 210-based Linux device - such as a development board or embedded media system - writes a crafted out-of-range integer to the tegra_ahub ALSA enum control interface. The kernel's tegra_ahub_put_value_enum() reads e->values[item[0]] prior to validating the index, causing an out-of-bounds kernel memory read; depending on the memory layout, this either leaks kernel address-space contents useful for bypassing KASLR in a chained attack, or causes a kernel panic resulting in denial of service. … |
| Remediation | The primary remediation is upgrading the Linux kernel to a patched stable release: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, or 7.1.5 (or 7.2-rc1 for development kernels). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all deployed systems running Tegra 210 with vulnerable kernel versions and assess which are critical or exposed to untrusted local users. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today