CVE-2026-74332 - Vulnerability Details - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: acp-sdw-sof: Bound DAI link iteration create_sdw_dailinks() walks sof_dais until it finds an entry with initialised cleared, but sof_dais is allocated with exactly num_ends entries. If all entries are initialised, the loop reads past the end of the array. Pass the allocated entry count to create_sdw_dailinks() and stop before reading past the array.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Vendors	Products
Linux	Linux Kernel

No data.

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/0a5ff4000dd7a390139dd7823fef1de4963e490a
https://git.kernel.org/stable/c/4d992e63f52d58f52b724606c60ae7b37a1c582f
https://git.kernel.org/stable/c/86a64c049873fe4d4a6a378e27a333ab5631c4b2
https://git.kernel.org/stable/c/9e82497138abea7d5c6e65015663d907fbcbf6b4

History

Sat, 15 Aug 2026 06:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: acp-sdw-sof: Bound DAI link iteration create_sdw_dailinks() walks sof_dais until it finds an entry with initialised cleared, but sof_dais is allocated with exactly num_ends entries. If all entries are initialised, the loop reads past the end of the array. Pass the allocated entry count to create_sdw_dailinks() and stop before reading past the array.
Title		ASoC: amd: acp-sdw-sof: Bound DAI link iteration
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0a5ff4000dd7a390139dd7823fef1de4963e490a https://git.kernel.org/stable/c/4d992e63f52d58f52b724606c60ae7b37a1c582f https://git.kernel.org/stable/c/86a64c049873fe4d4a6a378e27a333ab5631c4b2 https://git.kernel.org/stable/c/9e82497138abea7d5c6e65015663d907fbcbf6b4

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:58:25.112Z

Updated: 2026-08-15T05:58:25.112Z

Reserved: 2026-08-15T05:44:03.885Z

Link: CVE-2026-74332

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:22:34.043

Modified: 2026-08-15T06:22:34.043

Link: CVE-2026-74332

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74332", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.885Z", "datePublished": "2026-08-15T05:58:25.112Z", "dateUpdated": "2026-08-15T05:58:25.112Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-15T05:58:25.112Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: amd: acp-sdw-sof: Bound DAI link iteration\n\ncreate_sdw_dailinks() walks sof_dais until it finds an entry with\ninitialised cleared, but sof_dais is allocated with exactly num_ends\nentries. If all entries are initialised, the loop reads past the end of\nthe array.\n\nPass the allocated entry count to create_sdw_dailinks() and stop before\nreading past the array."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/soc/amd/acp/acp-sdw-sof-mach.c"], "versions": [{"version": "6d8348ddc56ed43ba39d1e8adda13299201f32ed", "lessThan": "0a5ff4000dd7a390139dd7823fef1de4963e490a", "status": "affected", "versionType": "git"}, {"version": "6d8348ddc56ed43ba39d1e8adda13299201f32ed", "lessThan": "9e82497138abea7d5c6e65015663d907fbcbf6b4", "status": "affected", "versionType": "git"}, {"version": "6d8348ddc56ed43ba39d1e8adda13299201f32ed", "lessThan": "86a64c049873fe4d4a6a378e27a333ab5631c4b2", "status": "affected", "versionType": "git"}, {"version": "6d8348ddc56ed43ba39d1e8adda13299201f32ed", "lessThan": "4d992e63f52d58f52b724606c60ae7b37a1c582f", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/soc/amd/acp/acp-sdw-sof-mach.c"], "versions": [{"version": "6.12", "status": "affected"}, {"version": "0", "lessThan": "6.12", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.97", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.12.97"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "7.2-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/0a5ff4000dd7a390139dd7823fef1de4963e490a"}, {"url": "https://git.kernel.org/stable/c/9e82497138abea7d5c6e65015663d907fbcbf6b4"}, {"url": "https://git.kernel.org/stable/c/86a64c049873fe4d4a6a378e27a333ab5631c4b2"}, {"url": "https://git.kernel.org/stable/c/4d992e63f52d58f52b724606c60ae7b37a1c582f"}], "title": "ASoC: amd: acp-sdw-sof: Bound DAI link iteration", "x_generator": {"engine": "bippy-1.2.0"}}}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["sound/soc/amd/acp/acp-sdw-sof-mach.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "0a5ff4000dd7a390139dd7823fef1de4963e490a", "status": "affected", "version": "6d8348ddc56ed43ba39d1e8adda13299201f32ed", "versionType": "git"}, {"lessThan": "9e82497138abea7d5c6e65015663d907fbcbf6b4", "status": "affected", "version": "6d8348ddc56ed43ba39d1e8adda13299201f32ed", "versionType": "git"}, {"lessThan": "86a64c049873fe4d4a6a378e27a333ab5631c4b2", "status": "affected", "version": "6d8348ddc56ed43ba39d1e8adda13299201f32ed", "versionType": "git"}, {"lessThan": "4d992e63f52d58f52b724606c60ae7b37a1c582f", "status": "affected", "version": "6d8348ddc56ed43ba39d1e8adda13299201f32ed", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["sound/soc/amd/acp/acp-sdw-sof-mach.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.12"}, {"lessThan": "6.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.97", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: amd: acp-sdw-sof: Bound DAI link iteration\n\ncreate_sdw_dailinks() walks sof_dais until it finds an entry with\ninitialised cleared, but sof_dais is allocated with exactly num_ends\nentries. If all entries are initialised, the loop reads past the end of\nthe array.\n\nPass the allocated entry count to create_sdw_dailinks() and stop before\nreading past the array."}], "id": "CVE-2026-74332", "lastModified": "2026-08-15T06:22:34.043", "metrics": {}, "published": "2026-08-15T06:22:34.043", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0a5ff4000dd7a390139dd7823fef1de4963e490a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4d992e63f52d58f52b724606c60ae7b37a1c582f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/86a64c049873fe4d4a6a378e27a333ab5631c4b2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9e82497138abea7d5c6e65015663d907fbcbf6b4"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}