CVE-2026-98263ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config->type
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config->type stream_config is not initialized before being passed to sdw_stream_add_slave(). The type field may contain garbage and is later copied to stream->type by sdw_config_stream(). Zero-initialize stream_config so type defaults to SDW_STREAM_PCM. While at it, use snd_sdw_params_to_config() helper instead of open-coding the same logic.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 6, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 63a511284c9ea72696a5dd0a2d2721bdef19f774 before 6507055733a9d397289277408b52daf422f8a814; from 63a511284c9ea72696a5dd0a2d2721bdef19f774 before c144447c207e2be24d6ac86d544691ba464caad8; from 63a511284c9ea72696a5dd0a2d2721bdef19f774 before d93988c9e58d37b677f6ee8aceae741c8d1e30ad; from 63a511284c9ea72696a5dd0a2d2721bdef19f774 before a318ee718e7448cd6bf62d9b3197b6a6a8d4701e; 63a511284c9ea72696a5dd0a2d2721bdef19f774 builds before 03a5699a0a04309c597683967aaaf25d1e555ea2 | CNA record |
References
- https://git.kernel.org/stable/c/6507055733a9d397289277408b52daf422f8a814
- https://git.kernel.org/stable/c/c144447c207e2be24d6ac86d544691ba464caad8
- https://git.kernel.org/stable/c/d93988c9e58d37b677f6ee8aceae741c8d1e30ad
- https://git.kernel.org/stable/c/a318ee718e7448cd6bf62d9b3197b6a6a8d4701e
- https://git.kernel.org/stable/c/03a5699a0a04309c597683967aaaf25d1e555ea2
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.