CVE-2026-98744 ASoC: codecs: max98363: fix uninitialized stream_config->type
Uninitialized memory in the max98363 codec driver may leak kernel stack data to userspace, requiring a kernel patch.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98744?
CVE-2026-98744 is a vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ASoC: codecs: max98363: fix uninitialized stream_config->type
stream_config is not initialized before being passed to sdw_stream_add_slave(). The type field may contain garbage and is later copied to stream->type by sdw_config_stream().
Zero-initialize stream_config so type defaults to SDW_STREAM_PCM.
Which versions are affected by CVE-2026-98744?
How do I fix CVE-2026-98744?
Apply the vendor's patch.
Is CVE-2026-98744 being exploited?
There is no known exploitation of CVE-2026-98744 in the wild and no public exploit code.
Sources
Also known as AZL-109038, BELL-CVE-2026-98744, DEBIAN-CVE-2026-98744, GHSA-5h63-gmxc-wv3q, UBUNTU-CVE-2026-98744.