What’s Vulnerable › Vulnerabilities

CVE-2023-53400: ALSA: hda: Fix Oops by 9.1 surround channel names

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-09-18 · updated 2026-06-17

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: Fix Oops by 9.1 surround channel names get_line_out_pfx() may trigger an Oops by overflowing the static array with more than 8 channels. This was reported for MacBookPro 12,1 with Cirrus codec. As a workaround, extend for the 9.1 channels and also fix the potential Oops by unifying the code paths accessing the same array with the proper size check.

Affected products

• Linux kernel: before 4.14.316; from 4.15 before 4.19.284; from 4.20 before 5.4.244; from 5.5 before 5.10.181; from 5.11 before 5.15.113; from 5.16 before 6.1.30 — fixed in 4.14.316, 4.19.284, 5.10.181, 5.15.113, 5.4.244, 6.1.30

How to fix

Upgrade to a fixed version: Linux kernel 4.14.316, 4.19.284, 5.10.181, 5.15.113. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/082dcd51667b29097500c824c37f24da997a6a8a
• https://git.kernel.org/stable/c/3b44ec8c5c44790a82f07e90db45643c762878c6
• https://git.kernel.org/stable/c/4ef155ddf9578bf035964d58739fdcd7dd44b4a4
• https://git.kernel.org/stable/c/546b1f5f45a355ae0d3a8041cdaca597dfcac825
• https://git.kernel.org/stable/c/b5694aae4c2d9a288bafce7d38f122769e0428e6
• https://git.kernel.org/stable/c/dc8c569d59f17b17d7bca4f68c36bd571659921e
• https://git.kernel.org/stable/c/e8c7d7c43d5edd20e518fe1dfb2371d1fe6e8bb8
• https://git.kernel.org/stable/c/fcf637461019e9a5a0c12fc5c42a9db1779b0634

Get alerted when CVE-2023-53400 or the next vulnerability affects your stack