CVE-2023-52988

ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()

State: Published
Severity: 7.8 High
Published: Mar 27, 2025
Updated: Aug 5, 2026
Reserved: Mar 27, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()

snd_hda_get_connections() can return a negative error code. It may lead to accessing 'conn' array at a negative index.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-129 Improper Validation of Array Index

Affected Products

Product	Versions
LinuxLinux	30b4503378c976cf66201a1e81820519f6bd79ac to before 437e50ef6290ac835d526d0e45f466a0aa69ba1bAffected 30b4503378c976cf66201a1e81820519f6bd79ac to before 6e1f586ddec48d71016b81acf68ba9f49ca54db8Affected 30b4503378c976cf66201a1e81820519f6bd79ac to before d6870f3800dbb212ae8433183ee82f566d067c6cAffected 30b4503378c976cf66201a1e81820519f6bd79ac to before 2b557fa635e7487f638c0f030c305870839eeda2Affected 30b4503378c976cf66201a1e81820519f6bd79ac to before 1b9256c96220bcdba287eeeb90e7c910c77f8c46Affected 30b4503378c976cf66201a1e81820519f6bd79ac to before f011360ad234a07cb6fbcc720fff646a93a9f0d6Affected 30b4503378c976cf66201a1e81820519f6bd79ac to before b9cee506da2b7920b5ea02ccd8e78a907d0ee7aaAffected
LinuxLinux	3.1Affected before 3.1Not affected 4.14.306 through 4.14.Not affected 4.19.273 through 4.19.Not affected 5.4.232 through 5.4.Not affected 5.10.168 through 5.10.Not affected 5.15.93 through 5.15.Not affected 6.1.11 through 6.1.Not affected 6.2 and laterNot affected

Product

Versions

LinuxLinux

30b4503378c976cf66201a1e81820519f6bd79ac to before 437e50ef6290ac835d526d0e45f466a0aa69ba1bAffected
30b4503378c976cf66201a1e81820519f6bd79ac to before 6e1f586ddec48d71016b81acf68ba9f49ca54db8Affected
30b4503378c976cf66201a1e81820519f6bd79ac to before d6870f3800dbb212ae8433183ee82f566d067c6cAffected
30b4503378c976cf66201a1e81820519f6bd79ac to before 2b557fa635e7487f638c0f030c305870839eeda2Affected
30b4503378c976cf66201a1e81820519f6bd79ac to before 1b9256c96220bcdba287eeeb90e7c910c77f8c46Affected
30b4503378c976cf66201a1e81820519f6bd79ac to before f011360ad234a07cb6fbcc720fff646a93a9f0d6Affected
30b4503378c976cf66201a1e81820519f6bd79ac to before b9cee506da2b7920b5ea02ccd8e78a907d0ee7aaAffected

LinuxLinux

3.1Affected
before 3.1Not affected
4.14.306 through 4.14.*Not affected
4.19.273 through 4.19.*Not affected
5.4.232 through 5.4.*Not affected
5.10.168 through 5.10.*Not affected
5.15.93 through 5.15.*Not affected
6.1.11 through 6.1.*Not affected
6.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.