CVE-2026-74292ASoC: tegra: tegra210_ahub: Validate written enum value
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: ASoC: tegra: tegra210_ahub: Validate written enum value tegra_ahub_put_value_enum() reads e->values[item[0]] before checking whether item[0] is within the enum item range. The existing check therefore happens too late to prevent an out-of-range read of the values array. Move the check before the array access.
- CVSS
- 7.1 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 16e1bcc2caf446fa3e1daa040b59fd6f6272a766 builds before 4e45e4c2015519a39c40eb575c03b77807fb5080; from 16e1bcc2caf446fa3e1daa040b59fd6f6272a766 before 964f8f9015fb117402d8d2186593397cd93388e9; 16e1bcc2caf446fa3e1daa040b59fd6f6272a766 builds before 2ec7d16fe21c68b0879873a2abf9aac854c96134; 16e1bcc2caf446fa3e1daa040b59fd6f6272a766 builds before 4bcb23635d5059ee71f3fb89719ea14aada6fd59; from 16e1bcc2caf446fa3e1daa040b59fd6f6272a766 before f67d63628fe158b3a6e6b33a2b8c83ff118699d1; from 16e1bcc2caf446fa3e1daa040b59fd6f6272a766 before e098c9c6477dfa3cb363282100108484ceba5cc5; from 16e1bcc2caf446fa3e1daa040b59fd6f6272a766 before 226d93b65f4f99b35fb7a03bdb24acb577364ebc; 16e1bcc2caf446fa3e1daa040b59fd6f6272a766 builds before 1d8aabb413b5638670dfd1162169edc0ba276a2e | CNA record |
References
- https://git.kernel.org/stable/c/4e45e4c2015519a39c40eb575c03b77807fb5080
- https://git.kernel.org/stable/c/964f8f9015fb117402d8d2186593397cd93388e9
- https://git.kernel.org/stable/c/2ec7d16fe21c68b0879873a2abf9aac854c96134
- https://git.kernel.org/stable/c/4bcb23635d5059ee71f3fb89719ea14aada6fd59
- https://git.kernel.org/stable/c/f67d63628fe158b3a6e6b33a2b8c83ff118699d1
- https://git.kernel.org/stable/c/e098c9c6477dfa3cb363282100108484ceba5cc5
- https://git.kernel.org/stable/c/226d93b65f4f99b35fb7a03bdb24acb577364ebc
- https://git.kernel.org/stable/c/1d8aabb413b5638670dfd1162169edc0ba276a2e
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.