{"id":"CVE-2026-68348","title":"ASoC: tas2781: bound firmware description string parsing","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: tas2781: bound firmware description string parsing\n\nThe TAS2781 firmware parser reads several variable-length description\nstrings with strlen() before checking th…","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 915f5eadebd29ba185ac506766a90120153b7e14 < 3ddb0d3e36507615e5ef010a879357a54870adf5","Linux >= 915f5eadebd29ba185ac506766a90120153b7e14 < 0ec45e80a82785ee147516fdecf5c93707dec119","Linux >= 915f5eadebd29ba185ac506766a90120153b7e14 < 41ae2b7d37c3dd82302167496836cca9f0328374","Linux >= 915f5eadebd29ba185ac506766a90120153b7e14 < e75ef37d83c90b09bedb601624b47e168202b226","Linux >= 915f5eadebd29ba185ac506766a90120153b7e14 < bc889dfcea9294a1eae7f8e2f3573a90764ae4d0","Linux 6.5"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-16T15:47:21.509614Z"},"published":"2026-08-10","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:53:09.023Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-68348","references":[{"url":"https://git.kernel.org/stable/c/3ddb0d3e36507615e5ef010a879357a54870adf5"},{"url":"https://git.kernel.org/stable/c/0ec45e80a82785ee147516fdecf5c93707dec119"},{"url":"https://git.kernel.org/stable/c/41ae2b7d37c3dd82302167496836cca9f0328374"},{"url":"https://git.kernel.org/stable/c/e75ef37d83c90b09bedb601624b47e168202b226"},{"url":"https://git.kernel.org/stable/c/bc889dfcea9294a1eae7f8e2f3573a90764ae4d0"}],"tags":["cve.org"],"epss":0.00131,"epssPercentile":0.02387,"ingestedAt":"2026-10-16T17:24:46.859Z","slug":"CVE-2026-68348","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nASoC: tas2781: bound firmware description string parsing\n\nThe TAS2781 firmware parser reads several variable-length description\nstrings with strlen() before checking that the string terminator is\npresent inside the firmware blob. A malformed firmware image without a\nNUL terminator can therefore make the parser walk past the end of the\nfirmware buffer before the later size checks run.\n\nAdd a small bounded string-length helper and use it for all description\nfields that are parsed from the firmware buffer. Keep the existing size\nchecks for the fixed bytes that follow each string.\n\n## Affected\n\n- `Linux >= 915f5eadebd29ba185ac506766a90120153b7e14 < 3ddb0d3e36507615e5ef010a879357a54870adf5`\n- `Linux >= 915f5eadebd29ba185ac506766a90120153b7e14 < 0ec45e80a82785ee147516fdecf5c93707dec119`\n- `Linux >= 915f5eadebd29ba185ac506766a90120153b7e14 < 41ae2b7d37c3dd82302167496836cca9f0328374`\n- `Linux >= 915f5eadebd29ba185ac506766a90120153b7e14 < e75ef37d83c90b09bedb601624b47e168202b226`\n- `Linux >= 915f5eadebd29ba185ac506766a90120153b7e14 < bc889dfcea9294a1eae7f8e2f3573a90764ae4d0`\n- `Linux 6.5`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}