CVE-2026-74333

Received Received - Intake

Out-of-Bounds Read in AMD ACP SDW Legacy Sound Driver

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: acp-sdw-legacy: Bound DAI link iteration create_sdw_dailinks() walks soc_dais until it finds an entry with initialised cleared, but soc_dais is allocated with exactly num_ends entries. If all entries are initialised, the loop reads past the end of the array. This was reported by KASAN: BUG: KASAN: slab-out-of-bounds in mc_probe+0x26b3/0x2774 [snd_acp_sdw_legacy_mach] Read of size 1 Pass the allocated entry count to create_sdw_dailinks() and stop before reading past the array.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74333

EUVD

EUVD-2026-59480

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where a function called create_sdw_dailinks() incorrectly iterates over an array called soc_dais. The function stops only when it finds an uninitialized entry, but the array is allocated with exactly the number of entries needed. If all entries are initialized, the loop continues past the array's end, causing a buffer overflow. This was detected by KASAN, which reported a slab-out-of-bounds read error.

Detection Guidance

This vulnerability is specific to the Linux kernel's ASoC subsystem and may not have direct network detection methods. Check kernel logs for KASAN errors or slab-out-of-bounds warnings. Use commands like dmesg | grep -i kasan or journalctl -k | grep -i slab-out-of-bounds to detect issues.

Impact Analysis

This vulnerability could allow an attacker to cause a system crash or execute arbitrary code with kernel privileges. It may lead to denial-of-service conditions or unauthorized access to sensitive system data. Systems using the affected ASoC AMD sound driver component are at risk.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a Linux kernel memory safety issue that could lead to system instability or crashes. Compliance impacts would only occur if the vulnerability were exploited to cause data breaches or unauthorized access, which is not described here.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this vulnerability. Monitor kernel updates from your distribution and apply patches promptly. If custom kernel builds are used, ensure the fix is backported.

Hi! I’m here to help you understand CVE-2026-74333. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70