CVE-2024-46862

What it actually does

Missing empty terminator entry in snd_soc_acpi_link_adr array causes hda_sdw_machine_select() loop (testing !link->num_adr) to read past array bounds in struct snd_soc_acpi_mach handling.

Why it matters to the business

Audio device initialization failures or kernel crashes on Intel Meteor Lake platforms can disrupt end-user systems and require emergency patching.

How an attack unfolds

Local attacker triggers sound card or HD-audio initialization on an affected Intel system; the unbounded loop in machine selection reads invalid memory and may crash the kernel.

How to fix it

Upgrade Linux kernel to 6.10.11 or apply commit 01281a9e8275946aa725db0919769b8d35af3a11; rebuild and reboot affected systems.

How to confirm the fix worked

Verify kernel version >= 6.10.11 or presence of the commit; confirm snd_soc_acpi_intel_mtl_match table now contains a terminating empty link_adr entry.

Typical attack path

1. Obtain local code execution on target Linux system
2. Trigger ALSA or HD-audio subsystem initialization
3. Cause kernel to call hda_sdw_machine_select() on malformed array
4. Induce out-of-bounds read leading to panic or denial of service

How to detect it

Review kernel crash logs for oops in hda_sdw_machine_select or snd_soc_acpi_intel_mtl_match; no remote indicators exist.

What your security team should do

• Prioritize kernel updates on all Intel Meteor Lake systems within 30 days
• Monitor vendor firmware and distribution advisories for backported fixes
• Test audio functionality post-upgrade before broad deployment