Null Pointer Dereference in Linux ASoC SDCA Entity Name Allocation

Publication date: 2026-03-25

Last updated on: 2026-05-28

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ASoC: SDCA: Add allocation failure check for Entity name Currently find_sdca_entity_iot() can allocate a string for the Entity name but it doesn't check if that allocation succeeded. Add the missing NULL check after the allocation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-03-25

Last Modified

2026-05-28

Generated

2026-07-07

AI Q&A

2026-03-25

EPSS Evaluated

2026-07-06

NVD

CVE-2026-23301

EUVD

EUVD-2026-15236

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.19 (inc) to 6.19.7 (exc)
linux	linux_kernel	7.0
linux	linux_kernel	7.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-252	The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's ASoC SDCA component. Specifically, the function find_sdca_entity_iot() allocates memory for an Entity name string but does not check if the memory allocation was successful. This missing NULL check can lead to issues if the allocation fails.

Impact Analysis

If the allocation failure is not checked, it could lead to the program attempting to use a NULL pointer, which may cause crashes or undefined behavior in the Linux kernel. This can affect system stability and reliability.

Hi! I’m here to help you understand CVE-2026-23301. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70