CVE-2026-31619

Vulnerability

The ALSA fireworks driver in the Linux kernel handles EFW responses from FireWire devices. The status field in these responses is a 32-bit value supplied by the device, which is used as an index into the efr_status_names[] array. This array has only 17 entries, but the status value can range up to 0xFFFFFFFF, including the special value EFR_STATUS_INCOMPLETE (0x80000000). Without a bounds check, accessing the array with an out-of-range index results in an out-of-bounds read.

Exploitation

An attacker able to control or spoof a FireWire device can send a crafted EFW response with a malicious status value. This requires physical access to the FireWire bus or a compromised device on that bus. No authentication is needed beyond the ability to send EFW responses. The vulnerability can be triggered without special privileges beyond local access to the FireWire subsystem.

Impact

A successful out-of-bounds read could lead to information disclosure (reading kernel memory beyond the array) or a kernel crash (denial of service). The CVSS score of 5.5 (Medium) reflects the need for local access and the potential for modest information leakage.

Mitigation

The fix, applied in kernel stable commits [1][2][3][4], bounds the status index to the array size and prints "unknown" for unrecognized values. Users should update to a kernel version containing these commits to eliminate the vulnerability.