CVE-2026-98263
Received Received - Intake

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config->type stream_config is not initialized before being passed to sdw_stream_add_slave(). The type field may contain garbage and is later copied to stream->type by sdw_config_stream(). Zero-initialize stream_config so type defaults to SDW_STREAM_PCM. While at it, use snd_sdw_params_to_config() helper instead of open-coding the same logic.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-06
Last Modified
2026-10-06
Generated
2026-10-19
AI Q&A
2026-10-06
EPSS Evaluated
2026-10-18
NVD
CVE-2026-98263
EUVD
EUVD-2026-93191

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
Linux Linux 63a511284c9ea72696a5dd0a2d2721bdef19f774
Linux Linux 63a511284c9ea72696a5dd0a2d2721bdef19f774
Linux Linux 63a511284c9ea72696a5dd0a2d2721bdef19f774
Linux Linux 63a511284c9ea72696a5dd0a2d2721bdef19f774
Linux Linux 63a511284c9ea72696a5dd0a2d2721bdef19f774
Linux Linux 6.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves an uninitialized variable in the ASoC codec driver for rt712-sdca-dmic. The stream_config structure is passed to another function without being fully initialized, causing its type field to contain random data. This could lead to incorrect stream type handling in the SoundWire subsystem.

Detection Guidance

This vulnerability is specific to the Linux kernel's ASoC codec driver (rt712-sdca-dmic). Detection requires checking the kernel version and whether the affected driver is loaded. Use commands like 'uname -a' to check the kernel version and 'lsmod | grep rt712' to see if the driver is loaded.

Impact Analysis

This vulnerability could cause audio subsystem malfunctions on affected Linux systems. It may result in distorted audio, device initialization failures, or system instability when using sound devices with the rt712-sdca-dmic codec.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a low-level kernel issue related to uninitialized memory in audio codec handling, which could potentially lead to undefined behavior but does not involve data exposure or privacy violations.

Mitigation Strategies

Update the Linux kernel to a version that includes the fix for this vulnerability. If updating is not immediately possible, consider disabling the rt712-sdca-dmic driver if it is not required for your system.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98263. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart