CVE-2026-64041
Received Received - Intake

Buffer Overflow in Linux Kernel ASoC fs210x Codec

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: fs210x: fix possible buffer overflow In fs210x_effect_scene_info(), a string was copied like this: strscpy(DST, SRC, strlen(SRC) + 1); A buffer overflow would happen if strlen(SRC) >= sizeof(DST). Actually, strscpy() must be used this way: strscpy(DST, SRC, sizeof(DST)); strscpy(DST, SRC); // defaults to sizeof(DST)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64041
EUVD
EUVD-2026-45614

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a buffer overflow vulnerability in the Linux kernel's ASoC (ALSA System on Chip) codec driver for fs210x devices. It occurs in the fs210x_effect_scene_info() function where a string is copied unsafely using strscpy() with an incorrect buffer size. The vulnerable code uses strlen(SRC) + 1 instead of the proper buffer size, which could allow the source string to exceed the destination buffer if its length is equal to or larger than the destination size.

Detection Guidance

This vulnerability is specific to the Linux kernel's ASoC fs210x codec driver and requires code inspection or static analysis to detect. No direct network or system commands can identify this issue. Review the kernel source code for improper use of strscpy() in fs210x_effect_scene_info().

Check kernel logs for crashes or memory corruption errors related to audio drivers. Use tools like grep to search for strscpy misuse in kernel code: grep -r "strscpy" /usr/src/linux/sound/soc/codecs/

Impact Analysis

This vulnerability could allow an attacker to corrupt kernel memory by providing an overly long input string. This might lead to system crashes, privilege escalation, or arbitrary code execution within the kernel. Users running affected systems could experience instability or security breaches if the vulnerability is exploited.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a local buffer overflow in the Linux kernel's ASoC codec driver (fs210x), which could lead to memory corruption or crashes but does not involve data exposure or privacy violations.

Mitigation Strategies

Update your Linux kernel to the latest stable version where this issue is patched. If using a custom kernel, apply the official patch fixing the strscpy misuse in fs210x_effect_scene_info().

Disable the fs210x audio codec driver if not needed by blacklisting the module: echo "blacklist snd_soc_fs210x" >> /etc/modprobe.d/blacklist.conf

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64041. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart