CVE-2026-74332 (GCVE-0-2026-74332)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:58 – Updated: 2026-08-17 05:45
VLAI
Title
ASoC: amd: acp-sdw-sof: Bound DAI link iteration
Summary
In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: acp-sdw-sof: Bound DAI link iteration create_sdw_dailinks() walks sof_dais until it finds an entry with initialised cleared, but sof_dais is allocated with exactly num_ends entries. If all entries are initialised, the loop reads past the end of the array. Pass the allocated entry count to create_sdw_dailinks() and stop before reading past the array.
Severity
8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 6d8348ddc56ed43ba39d1e8adda13299201f32ed , < 0a5ff4000dd7a390139dd7823fef1de4963e490a (git)
Affected: 6d8348ddc56ed43ba39d1e8adda13299201f32ed , < 9e82497138abea7d5c6e65015663d907fbcbf6b4 (git)
Affected: 6d8348ddc56ed43ba39d1e8adda13299201f32ed , < 86a64c049873fe4d4a6a378e27a333ab5631c4b2 (git)
Affected: 6d8348ddc56ed43ba39d1e8adda13299201f32ed , < 4d992e63f52d58f52b724606c60ae7b37a1c582f (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.12
Unaffected: 0 , < 6.12 (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/soc/amd/acp/acp-sdw-sof-mach.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0a5ff4000dd7a390139dd7823fef1de4963e490a",
              "status": "affected",
              "version": "6d8348ddc56ed43ba39d1e8adda13299201f32ed",
              "versionType": "git"
            },
            {
              "lessThan": "9e82497138abea7d5c6e65015663d907fbcbf6b4",
              "status": "affected",
              "version": "6d8348ddc56ed43ba39d1e8adda13299201f32ed",
              "versionType": "git"
            },
            {
              "lessThan": "86a64c049873fe4d4a6a378e27a333ab5631c4b2",
              "status": "affected",
              "version": "6d8348ddc56ed43ba39d1e8adda13299201f32ed",
              "versionType": "git"
            },
            {
              "lessThan": "4d992e63f52d58f52b724606c60ae7b37a1c582f",
              "status": "affected",
              "version": "6d8348ddc56ed43ba39d1e8adda13299201f32ed",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/soc/amd/acp/acp-sdw-sof-mach.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: amd: acp-sdw-sof: Bound DAI link iteration\n\ncreate_sdw_dailinks() walks sof_dais until it finds an entry with\ninitialised cleared, but sof_dais is allocated with exactly num_ends\nentries. If all entries are initialised, the loop reads past the end of\nthe array.\n\nPass the allocated entry count to create_sdw_dailinks() and stop before\nreading past the array."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in create_sdw_dailinks() called from mc_probe() during SOF AMD PCI probe and platform_device_register_data(\"amd_sof_sdw\"); there is no network, Bluetooth, or remote-packet path\u2014only onboard SoundWire topology from ACPI/firmware on AMD ACP63/70 laptops.\nAC:L - On affected AMD SOF SoundWire machines where every ACPI endpoint gets its own dailink (aggregated=0), all num_ends array slots are initialised and the unbounded while loop deterministically performs a slab out-of-bounds read on every probe, with no race or attacker-controlled memory layout required.\nPR:N - The vulnerable path runs automatically during kernel driver probe at boot with no authentication, capability, or userspace gate; snd_sof PCI binding and amd_sof_sdw machine registration occur from the PCI ID table without any privilege check on this code path.\nUI:N - Exploitation requires no victim action\u2014the out-of-bounds access occurs inside mc_probe() during automatic machine-driver registration before any ALSA device open, mount, or other user interaction.\nS:U - The out-of-bounds read and any resulting kernel fault or heap corruption stay within the host kernel audio driver security boundary; this is not a VM escape, IOMMU bypass, or cross-authority sandbox breakout.\nC:H - The loop reads the initialised field past the kmalloc sof_dais[num_ends] boundary (KASAN slab-out-of-bounds, read size 1); if adjacent slab data is non-zero the walk continues, interpreting out-of-bounds asoc_sdw_dailink structures and dereferencing garbage list_head endpoints in create_sdw_dailink().\nI:H - When the out-of-bounds initialised byte is non-zero, create_sdw_dailink() processes attacker-uncontrolled dailink metadata and advances the dai_links pointer beyond the devm_kcalloc(num_links) allocation, enabling out-of-bounds writes into adjacent kernel heap objects during DAI link construction.\nA:H - Continuing past the array causes list_for_each_entry() on uninitialised endpoint lists and wild-pointer dereferences that produce a kernel oops/panic during probe; even the minimal one-byte slab OOB read is a confirmed memory-safety violation that can destabilize the audio subsystem on every boot of affected hardware."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:45:58.074Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0a5ff4000dd7a390139dd7823fef1de4963e490a"
        },
        {
          "url": "https://git.kernel.org/stable/c/9e82497138abea7d5c6e65015663d907fbcbf6b4"
        },
        {
          "url": "https://git.kernel.org/stable/c/86a64c049873fe4d4a6a378e27a333ab5631c4b2"
        },
        {
          "url": "https://git.kernel.org/stable/c/4d992e63f52d58f52b724606c60ae7b37a1c582f"
        }
      ],
      "title": "ASoC: amd: acp-sdw-sof: Bound DAI link iteration",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74332",
    "datePublished": "2026-08-15T05:58:25.112Z",
    "dateReserved": "2026-08-15T05:44:03.885Z",
    "dateUpdated": "2026-08-17T05:45:58.074Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74332",
      "date": "2026-09-21",
      "epss": "0.00142",
      "percentile": "0.03836"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "sound/soc/amd/acp/acp-sdw-sof-mach.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "0a5ff4000dd7a390139dd7823fef1de4963e490a",
                    "status": "affected",
                    "version": "6d8348ddc56ed43ba39d1e8adda13299201f32ed",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9e82497138abea7d5c6e65015663d907fbcbf6b4",
                    "status": "affected",
                    "version": "6d8348ddc56ed43ba39d1e8adda13299201f32ed",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "86a64c049873fe4d4a6a378e27a333ab5631c4b2",
                    "status": "affected",
                    "version": "6d8348ddc56ed43ba39d1e8adda13299201f32ed",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4d992e63f52d58f52b724606c60ae7b37a1c582f",
                    "status": "affected",
                    "version": "6d8348ddc56ed43ba39d1e8adda13299201f32ed",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "sound/soc/amd/acp/acp-sdw-sof-mach.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.12"
                  },
                  {
                    "lessThan": "6.12",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: amd: acp-sdw-sof: Bound DAI link iteration\n\ncreate_sdw_dailinks() walks sof_dais until it finds an entry with\ninitialised cleared, but sof_dais is allocated with exactly num_ends\nentries. If all entries are initialised, the loop reads past the end of\nthe array.\n\nPass the allocated entry count to create_sdw_dailinks() and stop before\nreading past the array."
          }
        ],
        "id": "CVE-2026-74332",
        "lastModified": "2026-08-17T06:19:27.670",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.4,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.5,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:22:34.043",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0a5ff4000dd7a390139dd7823fef1de4963e490a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4d992e63f52d58f52b724606c60ae7b37a1c582f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/86a64c049873fe4d4a6a378e27a333ab5631c4b2"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9e82497138abea7d5c6e65015663d907fbcbf6b4"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-20T18:15:48+00:00",
      "cve": "CVE-2026-74332",
      "id": "CVE-2026-74332",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ASoC: amd: acp-sdw-sof: Bound DAI link iteration",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74332.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-27T16:51:57Z",
      "cve": "CVE-2026-74332",
      "id": "CVE-2026-74332",
      "initial_release_date": "2026-08-27T16:51:57Z",
      "product_status:known_not_affected": "290",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74332",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74332.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.