EUVD-2026-59442
GHSA-gpjf-6x9p-w663
Severity by source
Sources disagree (Low–High)AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Local ALSA control access requires audio group membership (PR:L, AV:L); out-of-bounds read leaks kernel memory (C:H) and can crash kernel (A:H) with no write impact (I:N).
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
ASoC: codecs: hdac_hdmi: Validate written enum value
hdac_hdmi_set_pin_port_mux() uses the written enum value to index the texts array before calling snd_soc_dapm_put_enum_double(), which validates that the value is within the enum item range.
An out-of-range value can therefore make the driver read past the texts array before the helper rejects the write. Move the lookup after the helper has accepted the value.
AnalysisAI
Out-of-bounds read in the Linux kernel's ASoC hdac_hdmi HDMI audio codec driver allows a local attacker with low privileges to expose sensitive kernel memory or crash the kernel by writing a crafted out-of-range enum value to the ALSA control interface. The flaw exists in hdac_hdmi_set_pin_port_mux(), which indexes the texts array using the attacker-supplied value before the bounds-checking helper snd_soc_dapm_put_enum_double() has a chance to reject it. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) local interactive access to the target system or code execution at low-privilege user level; (2) membership in the audio group or equivalent direct write access to /dev/snd/controlCX character devices - a condition that is typically granted by default to interactive desktop users but not to server service accounts; (3) Intel HDA-compatible HDMI audio hardware physically present in the system; and (4) the snd_hda_codec_hdmi or hdac_hdmi kernel module loaded, which occurs automatically when compatible hardware is detected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) correctly captures the local-only attack vector and dual confidentiality-and-availability impact, but the real-world exploitation priority is substantially lower. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local attacker on a Linux desktop or shared workstation system with membership in the audio group (a common default in many Linux distributions for interactive users) opens the ALSA control interface for the Intel HDMI audio device and writes a crafted integer value beyond the valid enum range to the pin mux control. Before the bounds check executes, the kernel reads memory past the end of the texts array, potentially exposing kernel stack or heap contents; if the read triggers a fault, the kernel panics and the system crashes. … |
| Remediation | Upgrade the Linux kernel to a patched version: 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, or 7.2-rc1 depending on the stable branch in use. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running vulnerable Linux kernel versions affected by CVE-2026-74295 and assess which have local user access; prioritize production systems and critical infrastructure for patching. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today