EUVD-2026-57066Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
Local syscall with explicit device-object grant required justifies AV:L and PR:L; iterative OOB byte reads enable broad kernel memory reconstruction, warranting C:H.
Primary rating from Vendor (zephyr).
CVSS VectorVendor: zephyr
Lifecycle Timeline
2DescriptionCVE.org
The Intel ALH digital-audio-interface driver function dai_alh_get_properties() in drivers/dai/intel/alh/alh.c used a caller-supplied int stream_id with no range validation. The value indexes the fixed-size static const uint8_t alh_handshake_map[64] array and scales a FIFO register address, so an out-of-range stream_id produces an out-of-bounds read of one byte at an attacker-chosen signed offset from the array. That byte is written into prop->dma_hs_id and the resulting struct dai_properties is copied back to the caller, leaking it.
dai_get_properties_copy() is a Zephyr __syscall, and its verifier z_vrfy_dai_get_properties_copy() (drivers/dai/dai_handlers.c) validates only the device-object permission and the destination buffer, not stream_id. A user-mode thread that has been granted access to the ALH DAI device object can therefore call the syscall with an arbitrary stream_id, crossing the userspace/kernel sandbox boundary.
The impact is a one-byte-per-call arbitrary-offset kernel information disclosure (and leakage of a computed kernel address via fifo_address); a stream_id that resolves to an unmapped page faults in kernel context, giving a local denial of service. Exploitation requires CONFIG_USERSPACE and device access, making this a local, moderate-severity issue. The fix rejects negative and too-large stream_id values up front and returns NULL, which the copy wrapper maps to -ENOENT.
AnalysisAI
Kernel information disclosure and local denial of service affect Zephyr RTOS on Intel ALH-equipped hardware through an unvalidated stream_id parameter in the Intel ALH digital-audio-interface driver. A local user-mode thread holding explicit ALH device-object access can invoke the dai_get_properties_copy() syscall with an arbitrary stream_id, triggering an out-of-bounds read from the fixed 64-entry alh_handshake_map[] array and leaking one byte of kernel memory per call, along with a computed FIFO register address that can expose kernel address-space layout. No public exploit has been identified at time of analysis; exploitation is constrained to systems built with CONFIG_USERSPACE and where device-object access has been deliberately granted to untrusted threads.
Technical ContextAI
The Intel ALH (Audio Link Hub) is a digital audio interface peripheral found on Intel SoCs, managed in Zephyr RTOS by the driver at drivers/dai/intel/alh/alh.c. The function dai_alh_get_properties() accepts a caller-supplied int stream_id and uses it without range validation to index alh_handshake_map[64], a fixed-size static const uint8_t array, and to scale a FIFO register address. dai_get_properties_copy() is a Zephyr __syscall, meaning it is dispatched through Zephyr's kernel syscall mechanism, which enforces a userspace-to-kernel boundary. The syscall verifier z_vrfy_dai_get_properties_copy() in drivers/dai/dai_handlers.c validates the device-object permission of the calling thread and the output buffer pointer, but omits validation of the stream_id argument - the classic incomplete input validation pattern described by CWE-125 (Out-of-bounds Read). Because stream_id is a signed int, negative values produce negative array offsets, extending the read surface to memory before the array base as well as beyond its end. The resulting one-byte read is written into prop->dma_hs_id and the entire dai_properties struct is copied back to userspace. The affected CPE is cpe:2.3:a:zephyrproject:zephyr:*:*:*:*:*:*:*:*, covering all tracked Zephyr versions without a stated upper or lower version bound.
RemediationAI
The upstream fix is available as commit b470bfce689809621cc5cd8c04a4eca93795827a in the Zephyr project repository at https://github.com/zephyrproject-rtos/zephyr/commit/b470bfce689809621cc5cd8c04a4eca93795827a. The patch inserts a bounds check at the top of dai_alh_get_properties() that rejects any stream_id less than zero or greater than or equal to ARRAY_SIZE(alh_handshake_map), returning NULL, which the copy wrapper converts to -ENOENT returned to the caller. Operators should apply this commit to their Zephyr source tree and rebuild and reflash affected firmware. A specific tagged Zephyr release incorporating this fix was not identified in the available data - confirm patch inclusion by consulting Zephyr release notes or the GHSA-3557-j848-pv24 advisory at https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-3557-j848-pv24. If immediate patching is not feasible, two compensating controls exist with distinct trade-offs: disabling CONFIG_USERSPACE at build time fully eliminates the syscall attack surface but also removes all userspace thread isolation, which may break application functionality; alternatively, auditing and revoking ALH DAI device-object access grants from untrusted user-mode threads is the more surgical mitigation and closes the attack path without affecting kernel-internal use of the driver.
Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system. Rated critical severity (CVSS 10.0),
Possible variant of CVE-2021-3434 in function le_ecred_reconf_req. Rated critical severity (CVSS 9.8), this vulnerabilit
Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows. Rated critical severity (CVS
Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem. Rated critical severity (CVSS 9.8), this vulner
Integer Underflow in 6LoWPAN IPHC Header Uncompression in Zephyr. Rated critical severity (CVSS 9.8), this vulnerability
Buffer overflow in Zephyr USB DFU DNLOAD. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable
DOS: Incorrect 802154 Frame Validation for Omitted Source / Dest Addresses. Rated critical severity (CVSS 9.8), this vul
zephyr-rtos version 1.12.0 contains a NULL base pointer reference vulnerability in sys_ring_buf_put(), sys_ring_buf_get(
Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem. Rated critical severity (CVSS 9.6), this vul
Buffer overflow in Zephyr RTOS dns_unpack_name() function causing OOB writes. PoC available.
The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characte
Potential buffer overflows in the Bluetooth subsystem due to asserts being disabled in /subsys/bluetooth/host/hci_core.c
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today