CVE-2026-12232: Intel ALH Driver Information Disclosure

CVE-2026-12232 Overview

CVE-2026-12232 is an out-of-bounds read vulnerability [CWE-125] in the Zephyr RTOS Intel Audio Link Hub (ALH) digital-audio-interface driver. The flaw resides in the dai_alh_get_properties() function within drivers/dai/intel/alh/alh.c, which accepts a caller-supplied stream_id without range validation. A user-mode thread with access to the ALH DAI device object can invoke the dai_get_properties_copy() syscall with an arbitrary stream_id, crossing the userspace/kernel sandbox boundary. The result is a one-byte-per-call kernel information disclosure and leakage of a computed kernel address via fifo_address.

Critical Impact
Local attackers with device access can leak kernel memory contents byte-by-byte at attacker-chosen offsets and trigger kernel-context page faults, causing denial of service.

Affected Products

Zephyr RTOS builds using the Intel ALH DAI driver (drivers/dai/intel/alh/alh.c)
Zephyr configurations with CONFIG_USERSPACE enabled
Systems granting user-mode threads access to the ALH DAI device object

Discovery Timeline

2026-08-12 - CVE-2026-12232 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-12232

Vulnerability Analysis

The vulnerable function dai_alh_get_properties() uses the caller-supplied stream_id to index the fixed-size static const uint8_t alh_handshake_map[64] array. It also scales a FIFO register address using the same value. Without bounds validation, an out-of-range stream_id produces an out-of-bounds read of one byte at an attacker-chosen signed offset from the array. That byte is written into prop->dma_hs_id and the resulting struct dai_properties is copied back to the caller.

The syscall verifier z_vrfy_dai_get_properties_copy() in drivers/dai/dai_handlers.c validates only the device-object permission and the destination buffer. It does not validate stream_id, so an attacker-controlled value flows directly into the driver logic across the syscall boundary.

Root Cause

The root cause is missing input validation on an integer index used both as an array subscript and as a multiplier for kernel address computation. The signed int type allows negative offsets, expanding the readable range beyond forward overflow. Neither the driver function nor the syscall verifier enforced a [0, ARRAY_SIZE(alh_handshake_map)) constraint before the affected memory access.

Attack Vector

Exploitation requires local access and CONFIG_USERSPACE to be enabled, with the calling thread granted access to the ALH DAI device object. The attacker repeatedly invokes dai_get_properties_copy() with crafted stream_id values to read one byte per call at chosen offsets from alh_handshake_map. A stream_id that resolves to an unmapped page faults in kernel context, producing a local denial of service.

 	uint32_t offset = dir == DAI_DIR_PLAYBACK ?
 		ALH_TXDA_OFFSET : ALH_RXDA_OFFSET;
 
+	if (stream_id < 0 || (size_t)stream_id >= ARRAY_SIZE(alh_handshake_map)) {
+		LOG_ERR("invalid stream_id %d", stream_id);
+		return NULL;
+	}
+
 	prop->fifo_address = dai_base(dp) + offset + ALH_STREAM_OFFSET * stream_id;
 	prop->fifo_depth = ALH_GPDMA_BURST_LENGTH;
 	prop->dma_hs_id = alh_handshake_map[stream_id];

Source: Zephyr GitHub Commit b470bfc. The patch rejects negative and out-of-range stream_id values up front and returns NULL, which the copy wrapper maps to -ENOENT.

Detection Methods for CVE-2026-12232

Indicators of Compromise

Repeated invocations of the dai_get_properties_copy() syscall from a single user-mode thread with varying stream_id values
Kernel log entries indicating page faults or unexpected memory access from the ALH DAI code path
Unexpected values in prop->dma_hs_id returned to user space that do not correspond to valid handshake identifiers

Detection Strategies

Instrument the syscall verifier z_vrfy_dai_get_properties_copy() to log stream_id values outside the valid [0, 64) range
Audit firmware images and Zephyr build configurations for the presence of the vulnerable alh.c prior to commit b470bfce
Monitor for anomalous crash or reboot patterns on embedded devices exposing the ALH DAI to user-mode threads

Monitoring Recommendations

Enable Zephyr kernel logging at LOG_ERR level for DAI drivers to capture invalid stream_id errors after patching
Collect device crash telemetry and correlate with syscall audit records
Track deployment inventory of Zephyr-based devices to identify unpatched builds using the Intel ALH DAI driver

How to Mitigate CVE-2026-12232

Immediate Actions Required

Apply the upstream Zephyr patch from commit b470bfce689809621cc5cd8c04a4eca93795827a to all affected builds
Rebuild and redeploy firmware for any device using the Intel ALH DAI driver with CONFIG_USERSPACE enabled
Review device-object permission grants and restrict ALH DAI access to trusted kernel-mode components where feasible

Patch Information

The fix is available in the Zephyr project via the commit referenced in the Zephyr GitHub Commit b470bfc and documented in the Zephyr GitHub Security Advisory GHSA-3557-j848-pv24. The patch adds a range check that rejects negative values and values greater than or equal to ARRAY_SIZE(alh_handshake_map), returning NULL which the copy wrapper translates to -ENOENT.

Workarounds

Revoke user-mode thread access to the ALH DAI device object using Zephyr's kernel object permission APIs until the patch can be deployed
Disable CONFIG_USERSPACE on affected builds if user-mode isolation is not required for the deployment
Restrict application-level use of the dai_get_properties_copy() syscall through code review and static analysis

bash

# Configuration example: verify patched Zephyr tree includes the fix
git -C zephyr log --oneline b470bfce689809621cc5cd8c04a4eca93795827a
grep -n "invalid stream_id" zephyr/drivers/dai/intel/alh/alh.c