The Intel ALH digital-audio-interface driver function dai_alh_get_properties() in drivers/dai/intel/alh/alh.c used a caller-supplied int stream_id with no range validation. The value indexes the fixed-size static const uint8_t alh_handshake_map[64] array and scales a FIFO register address, so an out-of-range stream_id produces an out-of-bounds read of one byte at an attacker-chosen signed offset from the array. That byte is written into prop->dma_hs_id and the resulting struct dai_properties is copied back to the caller, leaking it.

dai_get_properties_copy() is a Zephyr __syscall, and its verifier z_vrfy_dai_get_properties_copy() (drivers/dai/dai_handlers.c) validates only the device-object permission and the destination buffer, not stream_id. A user-mode thread that has been granted access to the ALH DAI device object can therefore call the syscall with an arbitrary stream_id, crossing the userspace/kernel sandbox boundary.

The impact is a one-byte-per-call arbitrary-offset kernel information disclosure (and leakage of a computed kernel address via fifo_address); a stream_id that resolves to an unmapped page faults in kernel context, giving a local denial of service. Exploitation requires CONFIG_USERSPACE and device access, making this a local, moderate-severity issue. The fix rejects negative and too-large stream_id values up front and returns NULL, which the copy wrapper maps to -ENOENT.

Affected components

• drivers/dai/intel/alh

Affected versions

All releases shipping the Intel ALH DAI driver, including v4.4.0 (vulnerable code and the dai_get_properties_copy syscall both present in v4.4.0)

Fix

Fixed (merged) in b470bfc

Projected fixed version: 4.5.0 (the fix is merged on main but not yet released; this forecast should be confirmed against the actual release).

Introduced by: 638cfbb (drivers: dai: add ALH dai driver, 2022); userspace-reachable via the dai_get_properties_copy __syscall

Evidence

• drivers/dai/intel/alh/alh.c:149-156 — added bounds check; pre-fix the array index alh_handshake_map[stream_id] and fifo_address used stream_id unchecked
• drivers/dai/intel/alh/alh_map.h:15 — alh_handshake_map is a fixed uint8_t[64]; index is an unbounded signed int
• include/zephyr/drivers/dai.h:469-484 — dai_get_properties_copy is a __syscall passing stream_id to the driver
• drivers/dai/dai_handlers.c:63-72 — z_vrfy_dai_get_properties_copy validates device perm and dst buffer but NOT stream_id
• drivers/dai/intel/alh/alh.c:166-181 — dai_alh_get_properties_copy memcpy's the kernel prop struct (with the leaked byte) back to the caller
• v4.4.0:drivers/dai/intel/alh/alh.c — vulnerable code (no bounds check) and the syscall both shipped in v4.4.0

Patches

For more information

If you have any questions or comments about this advisory:

• Open an issue in zephyr
• Email us at Zephyr-vulnerabilities

embargo: 2026-08-11