CVE-2026-98263 ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config->type
An uninitialized variable in the Linux kernel RT712 SDCA DMIC driver may leak stack memory contents to local attackers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98263?
CVE-2026-98263 is a vulnerability in Linux, published on 6 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config->type
stream_config is not initialized before being passed to sdw_stream_add_slave(). The type field may contain garbage and is later copied to stream->type by sdw_config_stream().
Zero-initialize stream_config so type defaults to SDW_STREAM_PCM.
While at it, use snd_sdw_params_to_config() helper instead of open-coding the same logic.
Which versions are affected by CVE-2026-98263?
How do I fix CVE-2026-98263?
Apply the vendor's patch.
Is CVE-2026-98263 being exploited?
There is no known exploitation of CVE-2026-98263 in the wild and no public exploit code.
Sources
Also known as AZL-106008, BELL-CVE-2026-98263, DEBIAN-CVE-2026-98263, GHSA-8pw2-wmm5-rgrf, UBUNTU-CVE-2026-98263.