CVE-2026-63838
Received Received - Intake

Out-of-Bounds Access in Linux Kernel ASoC rsnd Component

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] component_dais[RSND_MAX_COMPONENT] is initially zero-initialized and later populated in rsnd_dai_of_node(). However, the existing boundary check: if (i >= RSND_MAX_COMPONENT) does not guarantee that the last valid element remains zero. As a result, the loop can rely on component_dais[RSND_MAX_COMPONENT] being zero, which may lead to an out-of-bounds access. Found by Linux Verification Center (linuxtesting.org) with SVACE.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63838
EUVD
EUVD-2026-45522

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Linux kernel's ASoC subsystem, specifically in the Renesas Sound (rsnd) driver. It involves a potential out-of-bounds access in the component_dais array due to an incorrect boundary check. The array is zero-initialized but the check does not ensure the last valid element remains zero, allowing the loop to access beyond the array's bounds.

Detection Guidance

This vulnerability is specific to the Linux kernel's ASoC subsystem and requires kernel source code analysis to detect. There are no direct network or system commands to detect it. Reviewing kernel logs for out-of-bounds access errors or analyzing the rsnd driver code for the described issue may help identify exploitation attempts.

Impact Analysis

This vulnerability could lead to memory corruption or crashes in systems using the affected Linux kernel component. An attacker with local access might exploit this to cause denial-of-service conditions or potentially execute arbitrary code, depending on the system configuration.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a low-level kernel memory access issue with limited impact scope.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to resolve the issue. If patches are unavailable, consider disabling the affected ASoC component or restricting access to sound device files. Monitor kernel logs for suspicious activity related to the rsnd driver.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63838. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart