CVE-2026-98940

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98940", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.381Z", "datePublished": "2026-10-23T12:12:08.487Z", "dateUpdated": "2026-10-30T12:40:27.052Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:40:27.052Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: qcom: lpass-cpu: use DAI table index for playback constraints\n\nThe DAI ID is a hardware port ID and is not necessarily the index of\nthe corresponding entry in variant->dai_driver.\n\nWhen configuring a DAI with LPAIF_I2SCTL_MODE_QUAD01, the probe code\ncurrently uses dai_id to index variant->dai_driver. This is incorrect\nfor platforms where DAI IDs are sparse. For example, the IPQ806x MI2S\nDAI has ID 4 while it is the only entry in the DAI driver table. If\nthat DAI is configured for QUAD01 and probe reaches this branch, the\ncode writes beyond that single entry via dai_driver[4] instead of\nupdating the DAI being processed.\n\nUse the loop index i when updating the current DAI's playback channel\nconstraints, while retaining dai_id for indexing the hardware-port\nspecific playback SD-line mode array.\n\nThis fixes the incorrect DAI table access for platforms where the DAI\nID does not match its position in the driver table."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/soc/qcom/lpass-cpu.c"], "versions": [{"version": "c223f41c1a52bfe10f1d3311679b1d1f9813e500", "lessThan": "c10823507a74d7474391c01121e3f59901b1789f", "status": "affected", "versionType": "git"}, {"version": "c223f41c1a52bfe10f1d3311679b1d1f9813e500", "lessThan": "63987bb73df65fb01245b5905b005aa47c1dd27a", "status": "affected", "versionType": "git"}, {"version": "c223f41c1a52bfe10f1d3311679b1d1f9813e500", "lessThan": "775df6a27e8433e2414124472938009b958f9a77", "status": "affected", "versionType": "git"}, {"version": "c223f41c1a52bfe10f1d3311679b1d1f9813e500", "lessThan": "6833f1893ac2ec40016c348779af63debf3700d2", "status": "affected", "versionType": "git"}, {"version": "c223f41c1a52bfe10f1d3311679b1d1f9813e500", "lessThan": "69d2b7a4c115181629eb14d800aecc3e7de3f7fb", "status": "affected", "versionType": "git"}, {"version": "c223f41c1a52bfe10f1d3311679b1d1f9813e500", "lessThan": "f11336e6d3cd9e28e5cdf1cb8a6171e7c3eff4e4", "status": "affected", "versionType": "git"}, {"version": "c223f41c1a52bfe10f1d3311679b1d1f9813e500", "lessThan": "ca51771c8efde5df05476ac98dd1b2af4e2b149f", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/soc/qcom/lpass-cpu.c"], "versions": [{"version": "5.14", "status": "affected"}, {"version": "0", "lessThan": "5.14", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.224", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.56", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "5.15.224"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.18.56"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "7.2.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/c10823507a74d7474391c01121e3f59901b1789f"}, {"url": "https://git.kernel.org/stable/c/63987bb73df65fb01245b5905b005aa47c1dd27a"}, {"url": "https://git.kernel.org/stable/c/775df6a27e8433e2414124472938009b958f9a77"}, {"url": "https://git.kernel.org/stable/c/6833f1893ac2ec40016c348779af63debf3700d2"}, {"url": "https://git.kernel.org/stable/c/69d2b7a4c115181629eb14d800aecc3e7de3f7fb"}, {"url": "https://git.kernel.org/stable/c/f11336e6d3cd9e28e5cdf1cb8a6171e7c3eff4e4"}, {"url": "https://git.kernel.org/stable/c/ca51771c8efde5df05476ac98dd1b2af4e2b149f"}], "title": "ASoC: qcom: lpass-cpu: use DAI table index for playback constraints", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["sound/soc/qcom/lpass-cpu.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "c10823507a74d7474391c01121e3f59901b1789f", "status": "affected", "version": "c223f41c1a52bfe10f1d3311679b1d1f9813e500", "versionType": "git"}, {"lessThan": "63987bb73df65fb01245b5905b005aa47c1dd27a", "status": "affected", "version": "c223f41c1a52bfe10f1d3311679b1d1f9813e500", "versionType": "git"}, {"lessThan": "775df6a27e8433e2414124472938009b958f9a77", "status": "affected", "version": "c223f41c1a52bfe10f1d3311679b1d1f9813e500", "versionType": "git"}, {"lessThan": "6833f1893ac2ec40016c348779af63debf3700d2", "status": "affected", "version": "c223f41c1a52bfe10f1d3311679b1d1f9813e500", "versionType": "git"}, {"lessThan": "69d2b7a4c115181629eb14d800aecc3e7de3f7fb", "status": "affected", "version": "c223f41c1a52bfe10f1d3311679b1d1f9813e500", "versionType": "git"}, {"lessThan": "f11336e6d3cd9e28e5cdf1cb8a6171e7c3eff4e4", "status": "affected", "version": "c223f41c1a52bfe10f1d3311679b1d1f9813e500", "versionType": "git"}, {"lessThan": "ca51771c8efde5df05476ac98dd1b2af4e2b149f", "status": "affected", "version": "c223f41c1a52bfe10f1d3311679b1d1f9813e500", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["sound/soc/qcom/lpass-cpu.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.14"}, {"lessThan": "5.14", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.224", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.56", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: qcom: lpass-cpu: use DAI table index for playback constraints\n\nThe DAI ID is a hardware port ID and is not necessarily the index of\nthe corresponding entry in variant->dai_driver.\n\nWhen configuring a DAI with LPAIF_I2SCTL_MODE_QUAD01, the probe code\ncurrently uses dai_id to index variant->dai_driver. This is incorrect\nfor platforms where DAI IDs are sparse. For example, the IPQ806x MI2S\nDAI has ID 4 while it is the only entry in the DAI driver table. If\nthat DAI is configured for QUAD01 and probe reaches this branch, the\ncode writes beyond that single entry via dai_driver[4] instead of\nupdating the DAI being processed.\n\nUse the loop index i when updating the current DAI's playback channel\nconstraints, while retaining dai_id for indexing the hardware-port\nspecific playback SD-line mode array.\n\nThis fixes the incorrect DAI table access for platforms where the DAI\nID does not match its position in the driver table."}], "id": "CVE-2026-98940", "lastModified": "2026-10-30T13:21:32.277", "metrics": {}, "published": "2026-10-23T13:17:14.960", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/63987bb73df65fb01245b5905b005aa47c1dd27a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6833f1893ac2ec40016c348779af63debf3700d2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/69d2b7a4c115181629eb14d800aecc3e7de3f7fb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/775df6a27e8433e2414124472938009b958f9a77"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c10823507a74d7474391c01121e3f59901b1789f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ca51771c8efde5df05476ac98dd1b2af4e2b149f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f11336e6d3cd9e28e5cdf1cb8a6171e7c3eff4e4"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: Denial of service via out-of-bounds write in Qualcomm LPASS driver", "id": "2559671", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559671"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nASoC: qcom: lpass-cpu: use DAI table index for playback constraints\nThe DAI ID is a hardware port ID and is not necessarily the index of\nthe corresponding entry in variant->dai_driver.\nWhen configuring a DAI with LPAIF_I2SCTL_MODE_QUAD01, the probe code\ncurrently uses dai_id to index variant->dai_driver. This is incorrect\nfor platforms where DAI IDs are sparse. For example, the IPQ806x MI2S\nDAI has ID 4 while it is the only entry in the DAI driver table. If\nthat DAI is configured for QUAD01 and probe reaches this branch, the\ncode writes beyond that single entry via dai_driver[4] instead of\nupdating the DAI being processed.\nUse the loop index i when updating the current DAI's playback channel\nconstraints, while retaining dai_id for indexing the hardware-port\nspecific playback SD-line mode array.\nThis fixes the incorrect DAI table access for platforms where the DAI\nID does not match its position in the driver table.", "A flaw was found in the Linux kernel's Qualcomm audio driver (LPASS CPU). When configuring digital audio interfaces on certain platforms, the driver uses a hardware port identifier instead of the table index to update playback constraints. This issue causes an out-of-bounds memory write, which can lead to memory corruption and a denial of service (DoS) due to a system crash."], "name": "CVE-2026-98940", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-23T12:12:08Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98940\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98940\nhttps://git.kernel.org/stable/c/6833f1893ac2ec40016c348779af63debf3700d2\nhttps://git.kernel.org/stable/c/69d2b7a4c115181629eb14d800aecc3e7de3f7fb\nhttps://git.kernel.org/stable/c/775df6a27e8433e2414124472938009b958f9a77\nhttps://git.kernel.org/stable/c/ca51771c8efde5df05476ac98dd1b2af4e2b149f\nhttps://git.kernel.org/stable/c/f11336e6d3cd9e28e5cdf1cb8a6171e7c3eff4e4"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c223f41c1a52bfe10f1d3311679b1d1f9813e500,775df6a27e8433e2414124472938009b958f9a77)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c223f41c1a52bfe10f1d3311679b1d1f9813e500,6833f1893ac2ec40016c348779af63debf3700d2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c223f41c1a52bfe10f1d3311679b1d1f9813e500,69d2b7a4c115181629eb14d800aecc3e7de3f7fb)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c223f41c1a52bfe10f1d3311679b1d1f9813e500,f11336e6d3cd9e28e5cdf1cb8a6171e7c3eff4e4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c223f41c1a52bfe10f1d3311679b1d1f9813e500,ca51771c8efde5df05476ac98dd1b2af4e2b149f)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.14"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.14)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.160,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.56,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.10,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c223f41c1a52bfe10f1d3311679b1d1f9813e500,775df6a27e8433e2414124472938009b958f9a77)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c223f41c1a52bfe10f1d3311679b1d1f9813e500,6833f1893ac2ec40016c348779af63debf3700d2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c223f41c1a52bfe10f1d3311679b1d1f9813e500,69d2b7a4c115181629eb14d800aecc3e7de3f7fb)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c223f41c1a52bfe10f1d3311679b1d1f9813e500,f11336e6d3cd9e28e5cdf1cb8a6171e7c3eff4e4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c223f41c1a52bfe10f1d3311679b1d1f9813e500,ca51771c8efde5df05476ac98dd1b2af4e2b149f)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.14"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.14)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.160,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.56,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.10,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-23T17:30:17.171289+00:00", "updated": "2026-10-29T22:15:04.249353+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}