CVE-2026-74291

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the ALSA System on Chip (ASoC) topology parser where PCM and DAI name strings stored in fixed-size UAPI arrays are not properly validated. While other parser paths use bounded strnlen() checks, the PCM and DAI paths pass these arrays directly to functions such as strlen(), devm kstrdup(), DAI lookup, and diagnostic prints. A malformed topology blob containing a non-NUL-terminated PCM, DAI, or stream capability name can cause the parser to read beyond the end of the fixed-size field.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.