CVE-2026-63838

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63838", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.015Z", "datePublished": "2026-07-19T14:04:34.454Z", "dateUpdated": "2026-07-19T14:04:34.454Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-07-19T14:04:34.454Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: rsnd: Fix potential out-of-bounds access of component_dais[]\n\ncomponent_dais[RSND_MAX_COMPONENT] is initially zero-initialized\nand later populated in rsnd_dai_of_node(). However, the existing boundary check:\n if (i >= RSND_MAX_COMPONENT)\n\ndoes not guarantee that the last valid element remains zero. As a result,\nthe loop can rely on component_dais[RSND_MAX_COMPONENT] being zero,\nwhich may lead to an out-of-bounds access.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/soc/renesas/rcar/core.c"], "versions": [{"version": "547b02f74e4ac1e7d295a6266d5bc93a647cd4ac", "lessThan": "9f1daac27ca28e98c8c0e4450de42bb68d547250", "status": "affected", "versionType": "git"}, {"version": "547b02f74e4ac1e7d295a6266d5bc93a647cd4ac", "lessThan": "15e7b2ac2455995a6af02b9d3da7a432837aaf72", "status": "affected", "versionType": "git"}, {"version": "547b02f74e4ac1e7d295a6266d5bc93a647cd4ac", "lessThan": "134c61925e9e9ee0f4fdbab5c3984d5bb024f5f5", "status": "affected", "versionType": "git"}, {"version": "547b02f74e4ac1e7d295a6266d5bc93a647cd4ac", "lessThan": "a62b3e6e42359a79158c134e3cf5c74fe160c3f5", "status": "affected", "versionType": "git"}, {"version": "547b02f74e4ac1e7d295a6266d5bc93a647cd4ac", "lessThan": "f9e437cddf6cf9e603bdaefe148c1f4792aaf39c", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/soc/renesas/rcar/core.c"], "versions": [{"version": "6.6", "status": "affected"}, {"version": "0", "lessThan": "6.6", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.141", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.91", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.33", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.10", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.6.141"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.12.91"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.18.33"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "7.0.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/9f1daac27ca28e98c8c0e4450de42bb68d547250"}, {"url": "https://git.kernel.org/stable/c/15e7b2ac2455995a6af02b9d3da7a432837aaf72"}, {"url": "https://git.kernel.org/stable/c/134c61925e9e9ee0f4fdbab5c3984d5bb024f5f5"}, {"url": "https://git.kernel.org/stable/c/a62b3e6e42359a79158c134e3cf5c74fe160c3f5"}, {"url": "https://git.kernel.org/stable/c/f9e437cddf6cf9e603bdaefe148c1f4792aaf39c"}], "title": "ASoC: rsnd: Fix potential out-of-bounds access of component_dais[]", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["sound/soc/renesas/rcar/core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "9f1daac27ca28e98c8c0e4450de42bb68d547250", "status": "affected", "version": "547b02f74e4ac1e7d295a6266d5bc93a647cd4ac", "versionType": "git"}, {"lessThan": "15e7b2ac2455995a6af02b9d3da7a432837aaf72", "status": "affected", "version": "547b02f74e4ac1e7d295a6266d5bc93a647cd4ac", "versionType": "git"}, {"lessThan": "134c61925e9e9ee0f4fdbab5c3984d5bb024f5f5", "status": "affected", "version": "547b02f74e4ac1e7d295a6266d5bc93a647cd4ac", "versionType": "git"}, {"lessThan": "a62b3e6e42359a79158c134e3cf5c74fe160c3f5", "status": "affected", "version": "547b02f74e4ac1e7d295a6266d5bc93a647cd4ac", "versionType": "git"}, {"lessThan": "f9e437cddf6cf9e603bdaefe148c1f4792aaf39c", "status": "affected", "version": "547b02f74e4ac1e7d295a6266d5bc93a647cd4ac", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["sound/soc/renesas/rcar/core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.6"}, {"lessThan": "6.6", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.141", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.91", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.33", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B1FBBDC0-E953-426A-B1BA-4C86DE9A153B", "versionEndExcluding": "6.6.141", "versionStartIncluding": "6.6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C918746B-DE6F-448F-A93E-A04C5481688D", "versionEndExcluding": "6.12.91", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "96D99E49-380D-43AB-BDBA-25C3AD018A9C", "versionEndExcluding": "6.18.33", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A13475D2-59BF-4716-94B5-7C1D239A2CF4", "versionEndExcluding": "7.0.10", "versionStartIncluding": "6.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: rsnd: Fix potential out-of-bounds access of component_dais[]\n\ncomponent_dais[RSND_MAX_COMPONENT] is initially zero-initialized\nand later populated in rsnd_dai_of_node(). However, the existing boundary check:\n if (i >= RSND_MAX_COMPONENT)\n\ndoes not guarantee that the last valid element remains zero. As a result,\nthe loop can rely on component_dais[RSND_MAX_COMPONENT] being zero,\nwhich may lead to an out-of-bounds access.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE."}], "id": "CVE-2026-63838", "lastModified": "2026-11-12T15:15:10.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-07-19T15:16:50.583", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/134c61925e9e9ee0f4fdbab5c3984d5bb024f5f5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/15e7b2ac2455995a6af02b9d3da7a432837aaf72"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9f1daac27ca28e98c8c0e4450de42bb68d547250"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a62b3e6e42359a79158c134e3cf5c74fe160c3f5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f9e437cddf6cf9e603bdaefe148c1f4792aaf39c"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: ASoC: rsnd: Fix potential out-of-bounds access of component_dais[]", "id": "2502308", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502308"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nASoC: rsnd: Fix potential out-of-bounds access of component_dais[]\ncomponent_dais[RSND_MAX_COMPONENT] is initially zero-initialized\nand later populated in rsnd_dai_of_node(). However, the existing boundary check:\nif (i >= RSND_MAX_COMPONENT)\ndoes not guarantee that the last valid element remains zero. As a result,\nthe loop can rely on component_dais[RSND_MAX_COMPONENT] being zero,\nwhich may lead to an out-of-bounds access.\nFound by Linux Verification Center (linuxtesting.org) with SVACE.", "A flaw was found in the Linux kernel's Advanced Linux Sound Architecture (ALSA) System on Chip (ASoC) Renesas Sound (rsnd) component. An incorrect boundary check during the population of the `component_dais` array can lead to an out-of-bounds memory access. This vulnerability occurs because a loop relies on an array element being zero, which is not guaranteed, potentially causing system instability or unexpected behavior."], "name": "CVE-2026-63838", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-63838\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-63838\nhttps://lore.kernel.org/linux-cve-announce/2026071928-CVE-2026-63838-5ee3@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[547b02f74e4ac1e7d295a6266d5bc93a647cd4ac,9f1daac27ca28e98c8c0e4450de42bb68d547250)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[547b02f74e4ac1e7d295a6266d5bc93a647cd4ac,15e7b2ac2455995a6af02b9d3da7a432837aaf72)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[547b02f74e4ac1e7d295a6266d5bc93a647cd4ac,134c61925e9e9ee0f4fdbab5c3984d5bb024f5f5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[547b02f74e4ac1e7d295a6266d5bc93a647cd4ac,a62b3e6e42359a79158c134e3cf5c74fe160c3f5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[547b02f74e4ac1e7d295a6266d5bc93a647cd4ac,f9e437cddf6cf9e603bdaefe148c1f4792aaf39c)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.6"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.6)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.141,7.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.91,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.33,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.10,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-21T13:15:04.896341+00:00", "updated": "2026-08-01T08:00:14.509491+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}