The vulnerability in the Linux kernel ALSA control subsystem involves improper validation of the buffer length before calling strnlen() in the snd_ctl_elem_init_enum_names() function. When the buffer length (buf_len) reaches zero but the loop continues, strnlen() is called with a max length of zero. While strnlen() normally returns zero in this case, the fortified implementation with CONFIG_FORTIFY_SOURCE performs an additional check against the dynamic object size. If the compiler (Clang) loses track of the pointer's object size, this triggers a BRK exception panic, causing a denial of service. The fix adds a guard to prevent calling strnlen() on an exhausted buffer.

The vulnerability results in a denial of service (kernel panic) due to a BRK exception triggered by calling fortified strnlen() with a zero max length on an exhausted buffer. There is no impact on confidentiality or integrity. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability was fixed by adding a buffer length check before calling strnlen() in the Linux kernel ALSA control code. Users should monitor official Linux kernel updates and apply patches when available.