Linux Kernel EUVD-2026-59480

Exploitation requires: (1) a Linux system with AMD ACP SoundWire-capable hardware where the snd_acp_sdw_legacy_mach module is loaded; (2) a specific runtime condition where all num_ends entries in the soc_dais array have the initialised flag set, causing the unbounded loop in create_sdw_dailinks() to walk past the allocation. This condition is reached during driver probe (mc_probe) and does not require any user interaction beyond system boot on affected hardware. Exploitation is limited by hardware specificity (AMD ACP SoundWire systems only), the narrow trigger condition (all DAI entries initialized), and the fact that the confirmed primitive is a read-of-size-1 with no demonstrated write capability. Systems without this AMD audio hardware are entirely unaffected regardless of kernel version.

Despite the NVD-assigned CVSS of 8.4 (C:H/I:H/A:H), real-world risk is considerably lower. The EPSS score of 0.17% (6th percentile) reflects this: exploitation is neither widespread nor likely automated. The provided CVSS vector (AV:L/AC:L/PR:N) overstates impact - the C:H/I:H ratings are inconsistent with the confirmed bug being a one-byte slab-out-of-bounds read with no write primitive demonstrated. A read-only OOB in a probe path is unlikely to yield reliable code execution without significant additional development. Denial of service (kernel panic/crash) is the most credible immediate impact. PR:N in the vector is technically debatable: the probe occurs automatically at boot on affected hardware, requiring no user interaction, but exploiting it maliciously would require local presence on a system with AMD SoundWire hardware. The vulnerability is not in CISA KEV and no public exploit code exists. The mismatch between CVSS impact and actual KASAN-confirmed bug behavior should be flagged - the C:H/I:H ratings are not independently confirmed by the description.

On a system running an unpatched Linux kernel with AMD SoundWire-capable audio hardware, the snd_acp_sdw_legacy_mach module loads during boot. If create_sdw_dailinks() encounters a soc_dais array where every entry has the initialised flag set, the loop reads one byte past the end of the heap allocation. In the worst case, this triggers a kernel panic or yields a byte of adjacent heap memory - potentially leaking kernel addresses or object state useful for further privilege escalation chaining. No public exploit code exists and additional development would be required to turn this into a reliable exploit.