{"id":"CVE-2026-74291","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: topology: Check PCM and DAI name strings before use\n\nTopology objects store several PCM and DAI names in fixed-size UAPI\narrays","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: topology: Check PCM and DAI name strings before use\n\nTopology objects store several PCM and DAI names in fixed-size UAPI\narrays. Other topology parser paths valid…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 64527e8a352968bda529f01df1c9dd5fe581ff04 < 473f7d25d93e80db526a9d05887f0071abdc6d9b","Linux >= 64527e8a352968bda529f01df1c9dd5fe581ff04 < 5c2537cf24d673956b4e58029001667f89586fa2","Linux >= 64527e8a352968bda529f01df1c9dd5fe581ff04 < ba37b62ed0a443b8e23f53a7477e7f2537fd34c7","Linux >= 64527e8a352968bda529f01df1c9dd5fe581ff04 < b7e44d1986d6671342c19b82192189ca5db5dab7","Linux 4.6"],"published":"2026-08-15","updated":"2026-09-21","sourceUpdated":"2026-09-21T14:17:18.643","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74291","references":[{"url":"https://git.kernel.org/stable/c/473f7d25d93e80db526a9d05887f0071abdc6d9b","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5c2537cf24d673956b4e58029001667f89586fa2","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b7e44d1986d6671342c19b82192189ca5db5dab7","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ba37b62ed0a443b8e23f53a7477e7f2537fd34c7","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"epss":0.00168,"epssPercentile":0.06486,"ingestedAt":"2026-09-21T13:37:22.839Z","slug":"CVE-2026-74291","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nASoC: topology: Check PCM and DAI name strings before use\n\nTopology objects store several PCM and DAI names in fixed-size UAPI\narrays. Other topology parser paths validate these fields with bounded\nstrnlen() checks before using them as C strings, but the PCM and DAI\npaths still pass some fixed-size arrays directly to strlen(),\ndevm_kstrdup(), DAI lookup, and diagnostic prints.\n\nA malformed topology blob with a non-NUL-terminated PCM, DAI, or stream\ncapability name can therefore make the parser read past the end of the\nfixed-size field.\n\nReject unterminated PCM and DAI name fields before consuming them as C\nstrings.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}