CVE-2026-12232

Name of the Vulnerable Software and Affected Versions Zephyr (affected versions not specified)

Description The Intel ALH digital-audio-interface driver contains an issue where the dai alh get properties() function in drivers/dai/intel/alh/alh.c fails to validate the range of the caller-supplied stream id integer. This value is used to index the alh handshake map[64] array and scale a FIFO register address. An out-of-range stream id allows an out-of-bounds read of one byte at a signed offset from the array, which is then written into prop->dma hs id and leaked back to the caller via the dai properties structure.

Because the z vrfy dai get properties copy() verifier for the dai get properties copy() syscall does not validate stream id, a user-mode thread with access to the ALH DAI device object can bypass the userspace/kernel sandbox boundary. This can lead to a one-byte-per-call kernel information disclosure or a local denial of service if the stream id causes a page fault in the kernel context. Exploitation requires CONFIG USERSPACE and device access.

Recommendations As a temporary mitigation, restrict user-mode access to the ALH DAI device object. At the moment, there is no information about a newer version that contains a fix for this vulnerability.