{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74332", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.885Z", "datePublished": "2026-08-15T05:58:25.112Z", "dateUpdated": "2026-10-16T18:55:33.526Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:45:58.074Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: amd: acp-sdw-sof: Bound DAI link iteration\n\ncreate_sdw_dailinks() walks sof_dais until it finds an entry with\ninitialised cleared, but sof_dais is allocated with exactly num_ends\nentries. If all entries are initialised, the loop reads past the end of\nthe array.\n\nPass the allocated entry count to create_sdw_dailinks() and stop before\nreading past the array."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is in create_sdw_dailinks() called from mc_probe() during SOF AMD PCI probe and platform_device_register_data(\"amd_sof_sdw\"); there is no network, Bluetooth, or remote-packet path\u2014only onboard SoundWire topology from ACPI/firmware on AMD ACP63/70 laptops.\nAC:L - On affected AMD SOF SoundWire machines where every ACPI endpoint gets its own dailink (aggregated=0), all num_ends array slots are initialised and the unbounded while loop deterministically performs a slab out-of-bounds read on every probe, with no race or attacker-controlled memory layout required.\nPR:N - The vulnerable path runs automatically during kernel driver probe at boot with no authentication, capability, or userspace gate; snd_sof PCI binding and amd_sof_sdw machine registration occur from the PCI ID table without any privilege check on this code path.\nUI:N - Exploitation requires no victim action\u2014the out-of-bounds access occurs inside mc_probe() during automatic machine-driver registration before any ALSA device open, mount, or other user interaction.\nS:U - The out-of-bounds read and any resulting kernel fault or heap corruption stay within the host kernel audio driver security boundary; this is not a VM escape, IOMMU bypass, or cross-authority sandbox breakout.\nC:H - The loop reads the initialised field past the kmalloc sof_dais[num_ends] boundary (KASAN slab-out-of-bounds, read size 1); if adjacent slab data is non-zero the walk continues, interpreting out-of-bounds asoc_sdw_dailink structures and dereferencing garbage list_head endpoints in create_sdw_dailink().\nI:H - When the out-of-bounds initialised byte is non-zero, create_sdw_dailink() processes attacker-uncontrolled dailink metadata and advances the dai_links pointer beyond the devm_kcalloc(num_links) allocation, enabling out-of-bounds writes into adjacent kernel heap objects during DAI link construction.\nA:H - Continuing past the array causes list_for_each_entry() on uninitialised endpoint lists and wild-pointer dereferences that produce a kernel oops/panic during probe; even the minimal one-byte slab OOB read is a confirmed memory-safety violation that can destabilize the audio subsystem on every boot of affected hardware."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/soc/amd/acp/acp-sdw-sof-mach.c"], "versions": [{"version": "6d8348ddc56ed43ba39d1e8adda13299201f32ed", "lessThan": "0a5ff4000dd7a390139dd7823fef1de4963e490a", "status": "affected", "versionType": "git"}, {"version": "6d8348ddc56ed43ba39d1e8adda13299201f32ed", "lessThan": "9e82497138abea7d5c6e65015663d907fbcbf6b4", "status": "affected", "versionType": "git"}, {"version": "6d8348ddc56ed43ba39d1e8adda13299201f32ed", "lessThan": "86a64c049873fe4d4a6a378e27a333ab5631c4b2", "status": "affected", "versionType": "git"}, {"version": "6d8348ddc56ed43ba39d1e8adda13299201f32ed", "lessThan": "4d992e63f52d58f52b724606c60ae7b37a1c582f", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/soc/amd/acp/acp-sdw-sof-mach.c"], "versions": [{"version": "6.12", "status": "affected"}, {"version": "0", "lessThan": "6.12", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.97", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.12.97"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/0a5ff4000dd7a390139dd7823fef1de4963e490a"}, {"url": "https://git.kernel.org/stable/c/9e82497138abea7d5c6e65015663d907fbcbf6b4"}, {"url": "https://git.kernel.org/stable/c/86a64c049873fe4d4a6a378e27a333ab5631c4b2"}, {"url": "https://git.kernel.org/stable/c/4d992e63f52d58f52b724606c60ae7b37a1c582f"}], "title": "ASoC: amd: acp-sdw-sof: Bound DAI link iteration", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74332", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T18:53:43.086858Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T18:55:33.526Z"}}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["sound/soc/amd/acp/acp-sdw-sof-mach.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "0a5ff4000dd7a390139dd7823fef1de4963e490a", "status": "affected", "version": "6d8348ddc56ed43ba39d1e8adda13299201f32ed", "versionType": "git"}, {"lessThan": "9e82497138abea7d5c6e65015663d907fbcbf6b4", "status": "affected", "version": "6d8348ddc56ed43ba39d1e8adda13299201f32ed", "versionType": "git"}, {"lessThan": "86a64c049873fe4d4a6a378e27a333ab5631c4b2", "status": "affected", "version": "6d8348ddc56ed43ba39d1e8adda13299201f32ed", "versionType": "git"}, {"lessThan": "4d992e63f52d58f52b724606c60ae7b37a1c582f", "status": "affected", "version": "6d8348ddc56ed43ba39d1e8adda13299201f32ed", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["sound/soc/amd/acp/acp-sdw-sof-mach.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.12"}, {"lessThan": "6.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.97", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: amd: acp-sdw-sof: Bound DAI link iteration\n\ncreate_sdw_dailinks() walks sof_dais until it finds an entry with\ninitialised cleared, but sof_dais is allocated with exactly num_ends\nentries. If all entries are initialised, the loop reads past the end of\nthe array.\n\nPass the allocated entry count to create_sdw_dailinks() and stop before\nreading past the array."}], "id": "CVE-2026-74332", "lastModified": "2026-10-16T19:17:39.850", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-74332", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T18:53:43.086858Z", "version": "2.0.3"}}]}, "published": "2026-08-15T06:22:34.043", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0a5ff4000dd7a390139dd7823fef1de4963e490a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4d992e63f52d58f52b724606c60ae7b37a1c582f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/86a64c049873fe4d4a6a378e27a333ab5631c4b2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9e82497138abea7d5c6e65015663d907fbcbf6b4"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: ASoC: amd: acp-sdw-sof: Bound DAI link iteration", "id": "2516761", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516761"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nASoC: amd: acp-sdw-sof: Bound DAI link iteration\ncreate_sdw_dailinks() walks sof_dais until it finds an entry with\ninitialised cleared, but sof_dais is allocated with exactly num_ends\nentries. If all entries are initialised, the loop reads past the end of\nthe array.\nPass the allocated entry count to create_sdw_dailinks() and stop before\nreading past the array.", "A flaw was found in the Linux kernel's ASoC (Advanced Linux Sound Architecture System on Chip) AMD ACP SoundWire (SDW) SOF (Sound Open Firmware) driver. The `create_sdw_dailinks()` function, responsible for iterating through DAI (Digital Audio Interface) links, does not properly bound its iteration. This oversight could allow the function to read past the end of an allocated array, potentially leading to system instability or denial of service."], "name": "CVE-2026-74332", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74332\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74332\nhttps://lore.kernel.org/linux-cve-announce/2026081555-CVE-2026-74332-d98e@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6d8348ddc56ed43ba39d1e8adda13299201f32ed,0a5ff4000dd7a390139dd7823fef1de4963e490a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6d8348ddc56ed43ba39d1e8adda13299201f32ed,9e82497138abea7d5c6e65015663d907fbcbf6b4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6d8348ddc56ed43ba39d1e8adda13299201f32ed,86a64c049873fe4d4a6a378e27a333ab5631c4b2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6d8348ddc56ed43ba39d1e8adda13299201f32ed,4d992e63f52d58f52b724606c60ae7b37a1c582f)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.12"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.12)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.97,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.40,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T16:45:10.768643+00:00", "updated": "2026-08-17T12:30:06.130057+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-125"]}