CVE-2023-53788: Linux

EPSS: 0.2% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set() tuning_ctl_set() might have buffer overrun at (X) if it didn't break from loop by matching (A). static int tuning_ctl_set(...) { for (i = 0; i < TUNING_CTLS_COUNT; i++) (A) if (nid == ca0132_tuning_ctls[i].nid) break; snd_hda_power_up(...); (X) dspio_set_param(..., ca0132_tuning_ctls[i].mid, ...); snd_hda_power_down(...); ^ return 1; } We will get below error by cppcheck sound/pci/hda/patch_ca0132.c:4229:2: note: After for loop, i has value 12 for (i = 0; i < TUNING_CTLS_COUNT; i++) ^ sound/pci/hda/patch_ca0132.c:4234:43: note: Array index out of bounds dspio_set_param(codec, ca0132_tuning_ctls[i].mid, 0x20, ^ This patch cares non match case.

Affected products

• Linux Linux: from 3.9, before 4.14.312 (fixed in 4.14.312); from 4.15, before 4.19.280 (fixed in 4.19.280); from 4.20, before 5.4.240 (fixed in 5.4.240); from 5.5, before 5.10.177 (fixed in 5.10.177); from 5.11, before 5.15.106 (fixed in 5.15.106); from 5.16, before 6.1.23 (fixed in 6.1.23); …

Published 2025-12-09. Last modified 2026-06-17.