CVE-2026-74333 ASoC: amd: acp-sdw-legacy: Bound DAI link iteration
A missing bounds check in the AMD ACP SoundWire driver allows out-of-bounds reads, potentially causing a kernel crash.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-74333?
CVE-2026-74333 is a high-severity memory corruption vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ASoC: amd: acp-sdw-legacy: Bound DAI link iteration
create_sdw_dailinks() walks soc_dais until it finds an entry with initialised cleared, but soc_dais is allocated with exactly num_ends entries. If all entries are initialised, the loop reads past the end of the array.
This was reported by KASAN:
BUG: KASAN: slab-out-of-bounds in mc_probe+0x26b3/0x2774 [snd_acp_sdw_legacy_mach] Read of size 1
Pass the allocated entry count to create_sdw_dailinks() and stop before reading past the array.
Which versions are affected by CVE-2026-74333?
How do I fix CVE-2026-74333?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-74333 being exploited?
There is no known exploitation of CVE-2026-74333 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-74333, DEBIAN-CVE-2026-74333, GHSA-v5c2-5ccm-j5vq, UBUNTU-CVE-2026-74333.