CVE-2026-74291

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74291", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.881Z", "datePublished": "2026-08-15T05:57:57.631Z", "dateUpdated": "2026-10-30T12:29:38.001Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:29:38.001Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: topology: Check PCM and DAI name strings before use\n\nTopology objects store several PCM and DAI names in fixed-size UAPI\narrays. Other topology parser paths validate these fields with bounded\nstrnlen() checks before using them as C strings, but the PCM and DAI\npaths still pass some fixed-size arrays directly to strlen(),\ndevm_kstrdup(), DAI lookup, and diagnostic prints.\n\nA malformed topology blob with a non-NUL-terminated PCM, DAI, or stream\ncapability name can therefore make the parser read past the end of the\nfixed-size field.\n\nReject unterminated PCM and DAI name fields before consuming them as C\nstrings."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/soc/soc-topology.c"], "versions": [{"version": "64527e8a352968bda529f01df1c9dd5fe581ff04", "lessThan": "d09dad8dff862c4b5aac48b1223e512074ffeb08", "status": "affected", "versionType": "git"}, {"version": "64527e8a352968bda529f01df1c9dd5fe581ff04", "lessThan": "c405b07246bf179e9457de57501c3470175b165e", "status": "affected", "versionType": "git"}, {"version": "64527e8a352968bda529f01df1c9dd5fe581ff04", "lessThan": "473f7d25d93e80db526a9d05887f0071abdc6d9b", "status": "affected", "versionType": "git"}, {"version": "64527e8a352968bda529f01df1c9dd5fe581ff04", "lessThan": "5c2537cf24d673956b4e58029001667f89586fa2", "status": "affected", "versionType": "git"}, {"version": "64527e8a352968bda529f01df1c9dd5fe581ff04", "lessThan": "ba37b62ed0a443b8e23f53a7477e7f2537fd34c7", "status": "affected", "versionType": "git"}, {"version": "64527e8a352968bda529f01df1c9dd5fe581ff04", "lessThan": "b7e44d1986d6671342c19b82192189ca5db5dab7", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/soc/soc-topology.c"], "versions": [{"version": "4.6", "status": "affected"}, {"version": "0", "lessThan": "4.6", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/d09dad8dff862c4b5aac48b1223e512074ffeb08"}, {"url": "https://git.kernel.org/stable/c/c405b07246bf179e9457de57501c3470175b165e"}, {"url": "https://git.kernel.org/stable/c/473f7d25d93e80db526a9d05887f0071abdc6d9b"}, {"url": "https://git.kernel.org/stable/c/5c2537cf24d673956b4e58029001667f89586fa2"}, {"url": "https://git.kernel.org/stable/c/ba37b62ed0a443b8e23f53a7477e7f2537fd34c7"}, {"url": "https://git.kernel.org/stable/c/b7e44d1986d6671342c19b82192189ca5db5dab7"}], "title": "ASoC: topology: Check PCM and DAI name strings before use", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["sound/soc/soc-topology.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "d09dad8dff862c4b5aac48b1223e512074ffeb08", "status": "affected", "version": "64527e8a352968bda529f01df1c9dd5fe581ff04", "versionType": "git"}, {"lessThan": "c405b07246bf179e9457de57501c3470175b165e", "status": "affected", "version": "64527e8a352968bda529f01df1c9dd5fe581ff04", "versionType": "git"}, {"lessThan": "473f7d25d93e80db526a9d05887f0071abdc6d9b", "status": "affected", "version": "64527e8a352968bda529f01df1c9dd5fe581ff04", "versionType": "git"}, {"lessThan": "5c2537cf24d673956b4e58029001667f89586fa2", "status": "affected", "version": "64527e8a352968bda529f01df1c9dd5fe581ff04", "versionType": "git"}, {"lessThan": "ba37b62ed0a443b8e23f53a7477e7f2537fd34c7", "status": "affected", "version": "64527e8a352968bda529f01df1c9dd5fe581ff04", "versionType": "git"}, {"lessThan": "b7e44d1986d6671342c19b82192189ca5db5dab7", "status": "affected", "version": "64527e8a352968bda529f01df1c9dd5fe581ff04", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["sound/soc/soc-topology.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.6"}, {"lessThan": "4.6", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: topology: Check PCM and DAI name strings before use\n\nTopology objects store several PCM and DAI names in fixed-size UAPI\narrays. Other topology parser paths validate these fields with bounded\nstrnlen() checks before using them as C strings, but the PCM and DAI\npaths still pass some fixed-size arrays directly to strlen(),\ndevm_kstrdup(), DAI lookup, and diagnostic prints.\n\nA malformed topology blob with a non-NUL-terminated PCM, DAI, or stream\ncapability name can therefore make the parser read past the end of the\nfixed-size field.\n\nReject unterminated PCM and DAI name fields before consuming them as C\nstrings."}], "id": "CVE-2026-74291", "lastModified": "2026-10-30T13:19:54.373", "metrics": {}, "published": "2026-08-15T06:22:28.670", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/473f7d25d93e80db526a9d05887f0071abdc6d9b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5c2537cf24d673956b4e58029001667f89586fa2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b7e44d1986d6671342c19b82192189ca5db5dab7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ba37b62ed0a443b8e23f53a7477e7f2537fd34c7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c405b07246bf179e9457de57501c3470175b165e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d09dad8dff862c4b5aac48b1223e512074ffeb08"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: ASoC: topology: Check PCM and DAI name strings before use", "id": "2516884", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516884"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nASoC: topology: Check PCM and DAI name strings before use\nTopology objects store several PCM and DAI names in fixed-size UAPI\narrays. Other topology parser paths validate these fields with bounded\nstrnlen() checks before using them as C strings, but the PCM and DAI\npaths still pass some fixed-size arrays directly to strlen(),\ndevm_kstrdup(), DAI lookup, and diagnostic prints.\nA malformed topology blob with a non-NUL-terminated PCM, DAI, or stream\ncapability name can therefore make the parser read past the end of the\nfixed-size field.\nReject unterminated PCM and DAI name fields before consuming them as C\nstrings.", "A flaw was found in the Linux kernel's ASoC (Audio System on Chip) topology component. This vulnerability allows a local attacker to provide a specially crafted, malformed audio topology configuration (blob) with non-NUL-terminated name strings. This can cause the parser to read beyond the intended memory boundary, potentially leading to an out-of-bounds read and information disclosure."], "name": "CVE-2026-74291", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74291\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74291\nhttps://lore.kernel.org/linux-cve-announce/2026081548-CVE-2026-74291-9be4@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[64527e8a352968bda529f01df1c9dd5fe581ff04,ba37b62ed0a443b8e23f53a7477e7f2537fd34c7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[64527e8a352968bda529f01df1c9dd5fe581ff04,b7e44d1986d6671342c19b82192189ca5db5dab7)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.6"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.6)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T12:45:06.850646+00:00", "updated": "2026-08-22T03:00:12.258251+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}