CVE-2023-53400 ALSA: hda: Fix Oops by 9.1 surround channel names
A buffer overflow in the Linux kernel ALSA HDA driver allows local attackers to cause a system crash via specific audio channel configurations.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-53400?
CVE-2023-53400 is a medium-severity vulnerability in Linux kernel, published on 18 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ALSA: hda: Fix Oops by 9.1 surround channel names
get_line_out_pfx() may trigger an Oops by overflowing the static array with more than 8 channels. This was reported for MacBookPro 12,1 with Cirrus codec.
As a workaround, extend for the 9.1 channels and also fix the potential Oops by unifying the code paths accessing the same array with the proper size check.
Which versions are affected by CVE-2023-53400?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2023-53400?
Apply the vendor's patch.
Is CVE-2023-53400 being exploited?
There is no known exploitation of CVE-2023-53400 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2023-53400, DEBIAN-CVE-2023-53400, GHSA-v5r3-56fh-wjxj, UBUNTU-CVE-2023-53400.