CVE-2026-74333 (GCVE-0-2026-74333)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:58 – Updated: 2026-08-17 05:46
VLAI
Title
ASoC: amd: acp-sdw-legacy: Bound DAI link iteration
Summary
In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: acp-sdw-legacy: Bound DAI link iteration create_sdw_dailinks() walks soc_dais until it finds an entry with initialised cleared, but soc_dais is allocated with exactly num_ends entries. If all entries are initialised, the loop reads past the end of the array. This was reported by KASAN: BUG: KASAN: slab-out-of-bounds in mc_probe+0x26b3/0x2774 [snd_acp_sdw_legacy_mach] Read of size 1 Pass the allocated entry count to create_sdw_dailinks() and stop before reading past the array.
Severity
8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 2981d9b0789c44b7375e7d599caf71bd843afc9e , < 1279bdab5fa1f28c168e54215db506e87c6fac1e (git)
Affected: 2981d9b0789c44b7375e7d599caf71bd843afc9e , < 0230471eef5902207516851dcd47c559571dded2 (git)
Affected: 2981d9b0789c44b7375e7d599caf71bd843afc9e , < d49ecdf327cc91062d2f80996a163cf65fda1e60 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.13
Unaffected: 0 , < 6.13 (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/soc/amd/acp/acp-sdw-legacy-mach.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1279bdab5fa1f28c168e54215db506e87c6fac1e",
              "status": "affected",
              "version": "2981d9b0789c44b7375e7d599caf71bd843afc9e",
              "versionType": "git"
            },
            {
              "lessThan": "0230471eef5902207516851dcd47c559571dded2",
              "status": "affected",
              "version": "2981d9b0789c44b7375e7d599caf71bd843afc9e",
              "versionType": "git"
            },
            {
              "lessThan": "d49ecdf327cc91062d2f80996a163cf65fda1e60",
              "status": "affected",
              "version": "2981d9b0789c44b7375e7d599caf71bd843afc9e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/soc/amd/acp/acp-sdw-legacy-mach.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: amd: acp-sdw-legacy: Bound DAI link iteration\n\ncreate_sdw_dailinks() walks soc_dais until it finds an entry with\ninitialised cleared, but soc_dais is allocated with exactly num_ends\nentries. If all entries are initialised, the loop reads past the end of\nthe array.\n\nThis was reported by KASAN:\n\n  BUG: KASAN: slab-out-of-bounds in mc_probe+0x26b3/0x2774 [snd_acp_sdw_legacy_mach]\n  Read of size 1\n\nPass the allocated entry count to create_sdw_dailinks() and stop before\nreading past the array."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is only reachable during local AMD ACP PCI/platform driver probe (snd_acp63_probe -\u003e acp63_machine_register -\u003e mc_probe); there is no network, Bluetooth, or userspace syscall/ioctl path to create_sdw_dailinks().\nAC:L - On affected AMD SoundWire legacy laptops, when every soc_dais slot is marked initialised the OOB read is deterministic at each boot/probe; KASAN already hit this in mc_probe on real hardware, so no attacker-controlled race or rare timing is required.\nPR:N - Exploitation needs no credentials: mc_probe runs automatically during pre-login kernel initialization when ACPI/PCI matches an amd_sdw machine table on built-in SoundWire hardware, before any authenticated user session exists.\nUI:N - No victim interaction is required beyond normal system boot on vulnerable AMD SoundWire hardware; the bug triggers during driver initialization, not from opening audio devices or mounting filesystems.\nS:U - Impact is confined to kernel heap corruption and crash/privilege escalation within the host kernel; this is not a VM escape, IOMMU bypass, or cross-security-authority boundary.\nC:H - The bug is a slab out-of-bounds read (KASAN: read of size 1) past the soc_dais array, which can disclose adjacent kernel heap objects and satisfies the guidance to rate out-of-bounds reads as High.\nI:H - After the OOB initialised check, the loop can treat adjacent slab memory as a valid asoc_sdw_dailink and call create_sdw_dailink(), corrupting list heads and allocation sizes and enabling further heap corruption or control-flow hijack.\nA:H - KASAN reported slab-out-of-bounds in mc_probe during audio card registration; continued iteration over corrupt structures can kernel oops/panic at boot, denying availability to all users on the machine."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:46:00.787Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1279bdab5fa1f28c168e54215db506e87c6fac1e"
        },
        {
          "url": "https://git.kernel.org/stable/c/0230471eef5902207516851dcd47c559571dded2"
        },
        {
          "url": "https://git.kernel.org/stable/c/d49ecdf327cc91062d2f80996a163cf65fda1e60"
        }
      ],
      "title": "ASoC: amd: acp-sdw-legacy: Bound DAI link iteration",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74333",
    "datePublished": "2026-08-15T05:58:25.781Z",
    "dateReserved": "2026-08-15T05:44:03.885Z",
    "dateUpdated": "2026-08-17T05:46:00.787Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74333",
      "date": "2026-09-21",
      "epss": "0.00142",
      "percentile": "0.03866"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "sound/soc/amd/acp/acp-sdw-legacy-mach.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "1279bdab5fa1f28c168e54215db506e87c6fac1e",
                    "status": "affected",
                    "version": "2981d9b0789c44b7375e7d599caf71bd843afc9e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0230471eef5902207516851dcd47c559571dded2",
                    "status": "affected",
                    "version": "2981d9b0789c44b7375e7d599caf71bd843afc9e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d49ecdf327cc91062d2f80996a163cf65fda1e60",
                    "status": "affected",
                    "version": "2981d9b0789c44b7375e7d599caf71bd843afc9e",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "sound/soc/amd/acp/acp-sdw-legacy-mach.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.13"
                  },
                  {
                    "lessThan": "6.13",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: amd: acp-sdw-legacy: Bound DAI link iteration\n\ncreate_sdw_dailinks() walks soc_dais until it finds an entry with\ninitialised cleared, but soc_dais is allocated with exactly num_ends\nentries. If all entries are initialised, the loop reads past the end of\nthe array.\n\nThis was reported by KASAN:\n\n  BUG: KASAN: slab-out-of-bounds in mc_probe+0x26b3/0x2774 [snd_acp_sdw_legacy_mach]\n  Read of size 1\n\nPass the allocated entry count to create_sdw_dailinks() and stop before\nreading past the array."
          }
        ],
        "id": "CVE-2026-74333",
        "lastModified": "2026-08-17T06:19:27.787",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.4,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.5,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:22:34.167",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0230471eef5902207516851dcd47c559571dded2"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1279bdab5fa1f28c168e54215db506e87c6fac1e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d49ecdf327cc91062d2f80996a163cf65fda1e60"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-20T18:15:53+00:00",
      "cve": "CVE-2026-74333",
      "id": "CVE-2026-74333",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ASoC: amd: acp-sdw-legacy: Bound DAI link iteration",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74333.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-27T16:51:55Z",
      "cve": "CVE-2026-74333",
      "id": "CVE-2026-74333",
      "initial_release_date": "2026-08-27T16:51:55Z",
      "product_status:known_not_affected": "290",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74333",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74333.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.