CVE-2026-74291 ASoC: topology: Check PCM and DAI name strings before use
A local attacker with high privileges can cause an out-of-bounds read in the Linux kernel ASoC topology parser by providing malformed name strings, potentially leaking memory or crashing the system.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-74291?
CVE-2026-74291 is a vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ASoC: topology: Check PCM and DAI name strings before use
Topology objects store several PCM and DAI names in fixed-size UAPI arrays. Other topology parser paths validate these fields with bounded strnlen() checks before using them as C strings, but the PCM and DAI paths still pass some fixed-size arrays directly to strlen(), devm_kstrdup(), DAI lookup, and diagnostic prints.
A malformed topology blob with a non-NUL-terminated PCM, DAI, or stream capability name can therefore make the parser read past the end of the fixed-size field.
Reject unterminated PCM and DAI name fields before consuming them as C strings.
Which versions are affected by CVE-2026-74291?
How do I fix CVE-2026-74291?
Apply the vendor's patch.
Is CVE-2026-74291 being exploited?
There is no known exploitation of CVE-2026-74291 in the wild and no public exploit code.
Sources
Also known as AZL-96384, BELL-CVE-2026-74291, DEBIAN-CVE-2026-74291, GHSA-wrjf-2g4j-cfrg, UBUNTU-CVE-2026-74291.