Linux Kernel EUVD-2026-59479

Exploitation requires local access to a system running a vulnerable Linux kernel version with AMD ACP SoundWire hardware present and the acp-sdw-sof driver loaded. The specific trigger is that all num_ends entries in the sof_dais array must already be initialized at the time create_sdw_dailinks() is called - a state that depends on the hardware's SoundWire endpoint configuration. Systems without AMD SoundWire hardware cannot reach this code path regardless of kernel version. The CVSS vector designates PR:N (no privileges required), though in practice interacting with audio device nodes may require local audio group membership or equivalent. Exploitation is bounded to information disclosure (out-of-bounds read); no arbitrary write or code execution capability has been described or inferred.

The provided CVSS 3.1 score of 8.4 with C:H/I:H/A:H is likely overstated relative to the described mechanism: the vulnerability is an out-of-bounds read, and the 'Information Disclosure' tag confirms the primary impact is kernel memory exposure rather than a demonstrated write primitive. The local attack vector (AV:L) and hard dependency on AMD SoundWire hardware substantially narrow the exploitable population - even a mid-sized municipal IT team in sopot running commodity x86 server hardware without AMD SoundWire audio controllers faces no practical exposure from this CVE. EPSS at 0.17% (6th percentile) reinforces that exploitation in the wild is essentially unobserved. The CVSS PR:N designation is questionable: triggering the audio subsystem code path in practice likely requires local audio group membership or equivalent access. This is best characterized as a kernel correctness fix with a theoretical information disclosure impact rather than an operationally urgent security emergency.

A local user on a system running a vulnerable kernel with AMD SoundWire hardware present triggers the acp-sdw-sof driver in a configuration where all sof_dais entries are initialized before create_sdw_dailinks() is called. The loop overruns the array boundary and reads adjacent kernel heap memory, potentially exposing kernel pointers, credentials, or cryptographic material present in that memory region. No public exploit code has been identified at time of analysis.