Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-74291

ASoC: topology: Check PCM and DAI name strings before use

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: ASoC: topology: Check PCM and DAI name strings before use Topology objects store several PCM and DAI names in fixed-size UAPI arrays. Other topology parser paths validate these fields with bounded strnlen() checks before using them as C strings, but the PCM and DAI paths still pass some fixed-size arrays directly to strlen(), devm_kstrdup(), DAI lookup, and diagnostic prints. A malformed topology blob with a non-NUL-terminated PCM, DAI, or stream capability name can therefore make the parser read past the end of the fixed-size field. Reject unterminated PCM and DAI name fields before consuming them as C strings.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 64527e8a352968bda529f01df1c9dd5fe581ff04 to < d09dad8dff862c4b5aac48b1223e512074ffeb08affected
  • 64527e8a352968bda529f01df1c9dd5fe581ff04 to < c405b07246bf179e9457de57501c3470175b165eaffected
  • 64527e8a352968bda529f01df1c9dd5fe581ff04 to < 473f7d25d93e80db526a9d05887f0071abdc6d9baffected
  • 64527e8a352968bda529f01df1c9dd5fe581ff04 to < 5c2537cf24d673956b4e58029001667f89586fa2affected
  • 64527e8a352968bda529f01df1c9dd5fe581ff04 to < ba37b62ed0a443b8e23f53a7477e7f2537fd34c7affected
  • 64527e8a352968bda529f01df1c9dd5fe581ff04 to < b7e44d1986d6671342c19b82192189ca5db5dab7affected

Linux Linux

Default version status: affected

  • 4.6affected
  • 0 to < 4.6unaffected
  • 6.1.191 to ≤ 6.1.*unaffected
  • 6.6.158 to ≤ 6.6.*unaffected
  • 6.12.111 to ≤ 6.12.*unaffected
  • 6.18.53 to ≤ 6.18.*unaffected
  • 7.1.5 to ≤ 7.1.*unaffected
  • 7.2 to ≤ *unaffected

References