CVE-2023-52988 ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
A local attacker can trigger a kernel crash by exploiting an out-of-bounds array access in the VIA HDA audio driver due to unchecked error codes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-52988?
CVE-2023-52988 is a high-severity vulnerability in Linux kernel, published on 27 Mar 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
snd_hda_get_connections() can return a negative error code. It may lead to accessing 'conn' array at a negative index.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Weakness: CWE-129
Which versions are affected by CVE-2023-52988?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2023-52988?
Apply the vendor's patch.
Is CVE-2023-52988 being exploited?
There is no known exploitation of CVE-2023-52988 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2023-52988, DEBIAN-CVE-2023-52988, GHSA-4j5r-8cvm-p98h, UBUNTU-CVE-2023-52988.