CVE-2026-98053

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98053", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:19:56.072Z", "datePublished": "2026-09-25T10:24:01.074Z", "dateUpdated": "2026-10-21T12:54:17.218Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:54:17.218Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: Intel: avs: Refactor and fix init_config access\n\nExisting code accesses enties found in ->init_configs array through\nindexes that are part of ->config_ids array. Those two are limited by:\n->num_init_configs and ->num_config_ids respectively. Using ID larger\nor equal to ->num_init_configs leads to out-of-bounds access:\n\navs_path_module_send_init_configs()\nloop:\n\t(...) &acomp->tplg->init_configs[ids[i]]\n\t\t\t\t\t^ out-of-bounds candidate\n\nRather than adding another if-statement, refactor the code. There is no\nneed to store the IDs, have a list of pointers to actual config-entries\ninstead. As the verification of ->init_config entries does not differ from\nverification of other types that are part of the topology.c file, simply\nreuse the code."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/soc/intel/avs/path.c", "sound/soc/intel/avs/topology.c", "sound/soc/intel/avs/topology.h"], "versions": [{"version": "8a49ef789b1be68242624d460df2ada8087308a7", "lessThan": "70ffcaf86a053be99daaf3b103beac0ad7136ca3", "status": "affected", "versionType": "git"}, {"version": "8a49ef789b1be68242624d460df2ada8087308a7", "lessThan": "75bd5ea9c858d89fb8862f23afb00783bf02cd7a", "status": "affected", "versionType": "git"}, {"version": "8a49ef789b1be68242624d460df2ada8087308a7", "lessThan": "8f20a0f4f7d638e83ae86db1719a24c7049762f5", "status": "affected", "versionType": "git"}, {"version": "8a49ef789b1be68242624d460df2ada8087308a7", "lessThan": "681e91035dc794896a904852040837190e5041f5", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/soc/intel/avs/path.c", "sound/soc/intel/avs/topology.c", "sound/soc/intel/avs/topology.h"], "versions": [{"version": "6.9", "status": "affected"}, {"version": "0", "lessThan": "6.9", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.12.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/70ffcaf86a053be99daaf3b103beac0ad7136ca3"}, {"url": "https://git.kernel.org/stable/c/75bd5ea9c858d89fb8862f23afb00783bf02cd7a"}, {"url": "https://git.kernel.org/stable/c/8f20a0f4f7d638e83ae86db1719a24c7049762f5"}, {"url": "https://git.kernel.org/stable/c/681e91035dc794896a904852040837190e5041f5"}], "title": "ASoC: Intel: avs: Refactor and fix init_config access", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["sound/soc/intel/avs/path.c", "sound/soc/intel/avs/topology.c", "sound/soc/intel/avs/topology.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "70ffcaf86a053be99daaf3b103beac0ad7136ca3", "status": "affected", "version": "8a49ef789b1be68242624d460df2ada8087308a7", "versionType": "git"}, {"lessThan": "75bd5ea9c858d89fb8862f23afb00783bf02cd7a", "status": "affected", "version": "8a49ef789b1be68242624d460df2ada8087308a7", "versionType": "git"}, {"lessThan": "8f20a0f4f7d638e83ae86db1719a24c7049762f5", "status": "affected", "version": "8a49ef789b1be68242624d460df2ada8087308a7", "versionType": "git"}, {"lessThan": "681e91035dc794896a904852040837190e5041f5", "status": "affected", "version": "8a49ef789b1be68242624d460df2ada8087308a7", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["sound/soc/intel/avs/path.c", "sound/soc/intel/avs/topology.c", "sound/soc/intel/avs/topology.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.9"}, {"lessThan": "6.9", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.114", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6F4F0F44-2856-4E10-A046-0A6A4C7B3412", "versionEndExcluding": "6.18.53", "versionStartIncluding": "6.9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "19917B2D-B4B2-4416-A482-9C7C4929A921", "versionEndExcluding": "7.2.7", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*", "matchCriteriaId": "11E35E1B-5DB4-4AB9-9706-CD73B799EADF", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.3:rc2:*:*:*:*:*:*", "matchCriteriaId": "14FD7B9A-4946-4511-8E63-6E13870CD4A8", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: Intel: avs: Refactor and fix init_config access\n\nExisting code accesses enties found in ->init_configs array through\nindexes that are part of ->config_ids array. Those two are limited by:\n->num_init_configs and ->num_config_ids respectively. Using ID larger\nor equal to ->num_init_configs leads to out-of-bounds access:\n\navs_path_module_send_init_configs()\nloop:\n\t(...) &acomp->tplg->init_configs[ids[i]]\n\t\t\t\t\t^ out-of-bounds candidate\n\nRather than adding another if-statement, refactor the code. There is no\nneed to store the IDs, have a list of pointers to actual config-entries\ninstead. As the verification of ->init_config entries does not differ from\nverification of other types that are part of the topology.c file, simply\nreuse the code."}], "id": "CVE-2026-98053", "lastModified": "2026-10-21T13:21:20.497", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-09-25T11:17:34.227", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/681e91035dc794896a904852040837190e5041f5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/70ffcaf86a053be99daaf3b103beac0ad7136ca3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/75bd5ea9c858d89fb8862f23afb00783bf02cd7a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8f20a0f4f7d638e83ae86db1719a24c7049762f5"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: ASoC: Intel: avs: Refactor and fix init_config access", "id": "2541195", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541195"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nASoC: Intel: avs: Refactor and fix init_config access\nExisting code accesses enties found in ->init_configs array through\nindexes that are part of ->config_ids array. Those two are limited by:\n->num_init_configs and ->num_config_ids respectively. Using ID larger\nor equal to ->num_init_configs leads to out-of-bounds access:\navs_path_module_send_init_configs()\nloop:\n(...) &acomp->tplg->init_configs[ids[i]]\n^ out-of-bounds candidate\nRather than adding another if-statement, refactor the code. There is no\nneed to store the IDs, have a list of pointers to actual config-entries\ninstead. As the verification of ->init_config entries does not differ from\nverification of other types that are part of the topology.c file, simply\nreuse the code.", "A flaw was found in the Linux kernel's Intel Audio Voice Speech (AVS) driver. This flaw may allow a local attacker to cause a Denial of Service (DoS) or expose sensitive kernel memory by triggering an out-of-bounds read. The issue occurs when the driver processes audio topology settings without adequately verifying configuration identifiers against array boundaries."], "name": "CVE-2026-98053", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98053\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98053\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98053.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8a49ef789b1be68242624d460df2ada8087308a7,75bd5ea9c858d89fb8862f23afb00783bf02cd7a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8a49ef789b1be68242624d460df2ada8087308a7,8f20a0f4f7d638e83ae86db1719a24c7049762f5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8a49ef789b1be68242624d460df2ada8087308a7,681e91035dc794896a904852040837190e5041f5)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.9"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.9)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.7,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T16:00:18.016129+00:00", "updated": "2026-09-30T09:45:07.312604+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}