CVE-2026-74291 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
ASoC: topology: Check PCM and DAI name strings before use
Topology objects store several PCM and DAI names in fixed-size UAPI arrays. Other topology parser paths validate these fields with bounded strnlen() checks before using them as C strings, but the PCM and DAI paths still pass some fixed-size arrays directly to strlen(), devm_kstrdup(), DAI lookup, and diagnostic prints.
A malformed topology blob with a non-NUL-terminated PCM, DAI, or stream capability name can therefore make the parser read past the end of the fixed-size field.
Reject unterminated PCM and DAI name fields before consuming them as C strings.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability in question affects the Linux kernel's sound subsystem, specifically within the Advanced SoC (ASoC) topology parsing functionality. This issue resides in the way the kernel handles topology objects that contain PCM (Pulse Code Modulation) and DAI (Digital Audio Interface) name strings stored in fixed-size User API (UAPI) arrays. The problem manifests when these name strings are processed without proper validation of their null termination status, creating potential for out-of-bounds memory access during parsing operations.
The technical flaw stems from inconsistent validation practices within the topology parser implementation where some code paths properly employ bounded strnlen() checks to validate string boundaries before processing, while others directly pass fixed-size arrays to functions like strlen(), devm_kstrdup(), DAI lookup mechanisms, and diagnostic print functions. This discrepancy creates an exploitable condition where malformed topology data containing non-null-terminated strings can cause the parser to read beyond allocated memory boundaries when attempting to determine string length or perform subsequent operations.
The operational impact of this vulnerability extends across multiple attack vectors within the audio subsystem, potentially enabling privilege escalation or denial-of-service conditions depending on exploitation context. When a malformed topology blob is processed, the parser's failure to validate name string termination allows for memory corruption scenarios that could be leveraged by attackers with access to topology data injection capabilities. The vulnerability affects any system utilizing the ASoC framework for audio processing, particularly embedded systems and devices where topology blobs might be dynamically loaded from untrusted sources.
Mitigation strategies should focus on implementing consistent validation across all topology parsing paths that process PCM and DAI name strings. The recommended approach involves adding explicit null termination checks before any string operations are performed, ensuring that all name fields are properly validated using bounded string functions similar to those already employed in other parser paths. This fix aligns with common security practices for preventing buffer overflows and adheres to the principle of least privilege by ensuring that all input data is validated before consumption. The vulnerability classification aligns with CWE-121 heap-based buffer overflow and maps to ATT&CK technique T1068, which involves exploiting vulnerabilities in system software to gain elevated privileges.
This remediation approach directly addresses the root cause by enforcing proper boundary checking on all name string fields within topology objects, preventing the parser from accessing memory beyond intended array boundaries. The fix maintains backward compatibility while strengthening the kernel's defenses against malformed input data that could otherwise lead to critical system instability or security compromise. Implementation should be tested thoroughly across various audio configurations to ensure no regression in legitimate functionality while providing robust protection against the identified class of vulnerabilities.