CVE-2026-74291

Received Received - Intake

Linux Kernel ASoC Topology PCM/DAI Name String Validation Flaw

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ASoC: topology: Check PCM and DAI name strings before use Topology objects store several PCM and DAI names in fixed-size UAPI arrays. Other topology parser paths validate these fields with bounded strnlen() checks before using them as C strings, but the PCM and DAI paths still pass some fixed-size arrays directly to strlen(), devm_kstrdup(), DAI lookup, and diagnostic prints. A malformed topology blob with a non-NUL-terminated PCM, DAI, or stream capability name can therefore make the parser read past the end of the fixed-size field. Reject unterminated PCM and DAI name fields before consuming them as C strings.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74291

EUVD

EUVD-2026-59438

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper handling of PCM and DAI name strings in topology objects. The issue occurs because some paths in the topology parser do not validate these strings with proper length checks before using them as C strings. A malformed topology blob with non-NUL-terminated names can cause the parser to read past the end of fixed-size arrays, leading to potential memory corruption or crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's ASoC topology component and requires examining kernel logs or topology files for malformed PCM or DAI name strings. Check kernel logs for topology-related errors using 'dmesg | grep -i topology' or inspect topology files in /lib/firmware for unterminated strings.

Impact Analysis

If exploited, this vulnerability could allow an attacker to cause a denial of service (system crash) or execute arbitrary code with kernel privileges. It may also enable information disclosure or privilege escalation on affected systems running vulnerable Linux kernel versions.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it pertains to a memory corruption issue in the Linux kernel's ASoC topology parser. Compliance impacts would depend on system-specific implementations and data processing, which are not addressed in this CVE.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this issue. If using a custom kernel, ensure the topology parser validates PCM and DAI name strings before processing. Monitor kernel logs for topology-related errors after applying updates.

Hi! I’m here to help you understand CVE-2026-74291. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70