CVE-2026-74295

Received Received - Intake

Heap-based Buffer Overflow in Linux Kernel ASoC HDMI Codec

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: hdac_hdmi: Validate written enum value hdac_hdmi_set_pin_port_mux() uses the written enum value to index the texts array before calling snd_soc_dapm_put_enum_double(), which validates that the value is within the enum item range. An out-of-range value can therefore make the driver read past the texts array before the helper rejects the write. Move the lookup after the helper has accepted the value.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74295

EUVD

EUVD-2026-59442

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the hdac_hdmi_set_pin_port_mux() function where an enum value is used to index an array before validation. The function writes an out-of-range enum value to the texts array, causing the driver to read past the array bounds before the helper function snd_soc_dapm_put_enum_double() can reject the invalid write.

Detection Guidance

This vulnerability is specific to the Linux kernel's ASoC HDMI codec driver. Detection requires checking the kernel version and verifying if the affected code path exists. Use commands like 'uname -a' to check the kernel version and 'grep hdac_hdmi /proc/modules' to confirm the module is loaded.

Impact Analysis

This vulnerability could allow an attacker to cause a buffer overflow or memory corruption in the Linux kernel, potentially leading to system crashes, privilege escalation, or arbitrary code execution. It affects systems using the ASoC hdac_hdmi codec driver.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a low-level kernel driver issue that could lead to memory corruption but does not involve data exposure or privacy violations typically addressed by these regulations.

Mitigation Strategies

Update the Linux kernel to the latest stable version where this vulnerability is patched. If immediate patching is not possible, consider disabling the affected module 'hdac_hdmi' using 'modprobe -r hdac_hdmi' as a temporary workaround.

Hi! I’m here to help you understand CVE-2026-74295. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70