Strix
75.5K

CVE-2026-74291

UnknownEPSS 0.17%

Last modified

CVE-2026-74291 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: ASoC: topology: Check PCM and DAI name strings before use Topology objects store several PCM and DAI names in fixed-size UAPI arrays. Other topology parser paths validate these fields with bounded strnlen() checks before using them as C strings, but the PCM and DAI paths still pass some fixed-size arrays directly to strlen(), devm_kstrdup(), DAI lookup, and diagnostic prints. A malformed topology blob with a non-NUL-terminated PCM, DAI, or stream capability name can therefore make the parser read past the end of the fixed-size field. Reject unterminated PCM and DAI name fields before consuming them as C strings.. EPSS estimates a 0.17% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: ASoC: topology: Check PCM and DAI name strings before use Topology objects store several PCM and DAI names in fixed-size UAPI arrays. Other topology parser paths validate these fields with bounded strnlen() checks before using them as C strings, but the PCM and DAI paths still pass some fixed-size arrays directly to strlen(), devm_kstrdup(), DAI lookup, and diagnostic prints. A malformed topology blob with a non-NUL-terminated PCM, DAI, or stream capability name can therefore make the parser read past the end of the fixed-size field. Reject unterminated PCM and DAI name fields before consuming them as C strings.

Metrics

EPSS Probability
0.17%

6.1th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 64527e8a352968bda529f01df1c9dd5fe581ff04, < d09dad8dff862c4b5aac48b1223e512074ffeb08; >= 64527e8a352968bda529f01df1c9dd5fe581ff04, < c405b07246bf179e9457de57501c3470175b165e; >= 64527e8a352968bda529f01df1c9dd5fe581ff04, < 473f7d25d93e80db526a9d05887f0071abdc6d9b; >= 64527e8a352968bda529f01df1c9dd5fe581ff04, < 5c2537cf24d673956b4e58029001667f89586fa2; >= 64527e8a352968bda529f01df1c9dd5fe581ff04, < ba37b62ed0a443b8e23f53a7477e7f2537fd34c7; >= 64527e8a352968bda529f01df1c9dd5fe581ff04, < b7e44d1986d6671342c19b82192189ca5db5dab7
LinuxLinux4.6

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-74291?
In the Linux kernel, the following vulnerability has been resolved: ASoC: topology: Check PCM and DAI name strings before use Topology objects store several PCM and DAI names in fixed-size UAPI arrays. Other topology parser paths validate these fields with bounded strnlen() checks before using them as C strings, but the PCM and DAI paths still pass some fixed-size arrays directly to strlen(), devm_kstrdup(), DAI lookup, and diagnostic prints. A malformed topology blob with a non-NUL-terminated PCM, DAI, or stream capability name can therefore make the parser read past the end of the fixed-size field. Reject unterminated PCM and DAI name fields before consuming them as C strings.
How severe is CVE-2026-74291?
Severity scoring for CVE-2026-74291 is pending analysis. The EPSS model estimates a 0.17% probability of exploitation in the next 30 days.
How do I fix CVE-2026-74291?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-74291?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST