High 8.4Published Aug 15, 2026

CVE-2026-74333ASoC: amd: acp-sdw-legacy: Bound DAI link iteration

Updated under an hour ago (2026-10-19 11:10 UTC)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: acp-sdw-legacy: Bound DAI link iteration create_sdw_dailinks() walks soc_dais until it finds an entry with initialised cleared, but soc_dais is allocated with exactly num_ends entries. If all entries are initialised, the loop reads past the end of the array. This was reported by KASAN: BUG: KASAN: slab-out-of-bounds in mc_probe+0x26b3/0x2774 [snd_acp_sdw_legacy_mach] Read of size 1 Pass the allocated entry count to create_sdw_dailinks() and stop before reading past the array.

CVSS: 8.4 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 16, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	2981d9b0789c44b7375e7d599caf71bd843afc9e builds before 1279bdab5fa1f28c168e54215db506e87c6fac1e; from 2981d9b0789c44b7375e7d599caf71bd843afc9e before 0230471eef5902207516851dcd47c559571dded2; from 2981d9b0789c44b7375e7d599caf71bd843afc9e before d49ecdf327cc91062d2f80996a163cf65fda1e60	CNA record

References

https://git.kernel.org/stable/c/1279bdab5fa1f28c168e54215db506e87c6fac1e
https://git.kernel.org/stable/c/0230471eef5902207516851dcd47c559571dded2
https://git.kernel.org/stable/c/d49ecdf327cc91062d2f80996a163cf65fda1e60

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.