The Intel ALH digital-audio-interface driver function dai_alh_get_properties() in Zephyr's drivers/dai/intel/alh/alh.c uses a caller-supplied integer stream_id without range validation. This stream_id indexes a fixed-size static array and scales a FIFO register address, causing an out-of-bounds read of one byte at an attacker-controlled offset. The byte read is written into a property structure returned to the caller, leaking kernel memory. The syscall dai_get_properties_copy() exposes this to user mode with only device-object permission validation, allowing a local user with device access to leak kernel information or cause a denial of service by triggering a fault with an invalid stream_id. The fix involves rejecting negative and out-of-range stream_id values, returning NULL to prevent the leak.

This vulnerability allows a local user with access to the ALH DAI device object and CONFIG_USERSPACE enabled to read one byte of kernel memory per syscall invocation, potentially leaking sensitive kernel information including computed kernel addresses. Additionally, providing an invalid stream_id that maps to an unmapped page can cause a kernel fault, resulting in a local denial of service. There is no indication of privilege escalation or remote exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix rejects invalid stream_id values to prevent out-of-bounds reads. Until an official fix is confirmed, restrict access to the ALH DAI device object to trusted users only and ensure CONFIG_USERSPACE is configured securely.