CVE-2026-74291ASoC: topology: Check PCM and DAI name strings before use
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: ASoC: topology: Check PCM and DAI name strings before use Topology objects store several PCM and DAI names in fixed-size UAPI arrays. Other topology parser paths validate these fields with bounded strnlen() checks before using them as C strings, but the PCM and DAI paths still pass some fixed-size arrays directly to strlen(), devm_kstrdup(), DAI lookup, and diagnostic prints. A malformed topology blob with a non-NUL-terminated PCM, DAI, or stream capability name can therefore make the parser read past the end of the fixed-size field. Reject unterminated PCM and DAI name fields before consuming them as C strings.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 3, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 64527e8a352968bda529f01df1c9dd5fe581ff04 before c405b07246bf179e9457de57501c3470175b165e; 64527e8a352968bda529f01df1c9dd5fe581ff04 builds before 473f7d25d93e80db526a9d05887f0071abdc6d9b; 64527e8a352968bda529f01df1c9dd5fe581ff04 builds before 5c2537cf24d673956b4e58029001667f89586fa2; from 64527e8a352968bda529f01df1c9dd5fe581ff04 before ba37b62ed0a443b8e23f53a7477e7f2537fd34c7; from 64527e8a352968bda529f01df1c9dd5fe581ff04 before b7e44d1986d6671342c19b82192189ca5db5dab7 | CNA record |
References
- https://git.kernel.org/stable/c/c405b07246bf179e9457de57501c3470175b165e
- https://git.kernel.org/stable/c/473f7d25d93e80db526a9d05887f0071abdc6d9b
- https://git.kernel.org/stable/c/5c2537cf24d673956b4e58029001667f89586fa2
- https://git.kernel.org/stable/c/ba37b62ed0a443b8e23f53a7477e7f2537fd34c7
- https://git.kernel.org/stable/c/b7e44d1986d6671342c19b82192189ca5db5dab7
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.