CVE-2026-74332 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
ASoC: amd: acp-sdw-sof: Bound DAI link iteration
create_sdw_dailinks() walks sof_dais until it finds an entry with initialised cleared, but sof_dais is allocated with exactly num_ends entries. If all entries are initialised, the loop reads past the end of the array.
Pass the allocated entry count to create_sdw_dailinks() and stop before reading past the array.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability resides in the AMD ACP (Audio Codec Processor) subsystem within the Linux kernel's sound architecture, specifically affecting the interaction between the sound wire protocol and the sof (Sound Open Firmware) dai links. The flaw manifests in the create_sdw_dailinks() function which is responsible for establishing digital audio interface connections between the host system and audio codecs through the sound wire protocol. The issue stems from improper bounds checking during array traversal operations, creating a classic buffer overread condition that could potentially lead to system instability or information disclosure.
The technical implementation of this vulnerability occurs when the function iterates through the sof_dais array without proper boundary validation. The code assumes that it will encounter an uninitialized entry before reaching the end of the allocated memory region, but this assumption fails when all entries in the array have been properly initialized. Since the sof_dais array is allocated with exactly num_ends entries, and the iteration logic continues until it finds a cleared initialization flag, the function eventually accesses memory beyond the allocated array bounds. This type of error directly maps to CWE-129 Insufficient Bound Checking and CWE-787 Out-of-bounds Write conditions commonly found in kernel space buffer management.
The operational impact of this vulnerability extends beyond simple memory corruption as it affects the audio subsystem's ability to properly establish device connections during system initialization or runtime configuration changes. When the array bounds are exceeded, the kernel may read invalid memory locations which could contain sensitive data from other kernel structures, potentially leading to information leakage or system crashes. The vulnerability is particularly concerning in embedded systems or server environments where audio functionality is critical for proper system operation and where such buffer overreads could be exploited by malicious actors to gain unauthorized access to kernel memory spaces.
Mitigation strategies should focus on implementing proper array boundary validation within the create_sdw_dailinks() function by passing the allocated entry count as a parameter to prevent the iteration from exceeding array limits. This approach aligns with established kernel security practices and follows the principle of least privilege in memory access operations. The fix should also incorporate defensive programming techniques such as using safe array traversal methods and implementing proper input validation for the num_ends parameter to ensure it does not exceed expected bounds. Additionally, this vulnerability demonstrates the importance of thorough testing for boundary conditions in kernel code and adherence to security guidelines outlined in the Linux Kernel Security documentation, particularly concerning device driver implementations that handle dynamic resource allocation and memory management operations.