https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 23:55:55 +0000 https://vulnerability.circl.lu/vuln/cve-2026-46088 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names()</p> <p>snd_ctl_elem_init_enum_names() advances pointer p through the names buffer while decrementing buf_len. If buf_len reaches zero but items remain, the next iteration calls strnlen(p, 0).</p> <p>While strnlen(p, 0) returns 0 and would hit the existing name_len == 0 error path, CONFIG_FORTIFY_SOURCE&#39;s fortified strnlen() first checks maxlen against __builtin_dynamic_object_size(). When Clang loses track of p&#39;s object size inside the loop, this triggers a BRK exception panic before the return value is examined.</p> <p>Add a buf_len == 0 guard at the loop entry to prevent calling fortified strnlen() on an exhausted buffer.</p> <p>Found by kernel fuzz testing through Xiaomi Smartphone.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names()</p> <p>snd_ctl_elem_init_enum_names() advances pointer p through the names buffer while decrementing buf_len. If buf_len reaches zero but items remain, the next iteration calls strnlen(p, 0).</p> <p>While strnlen(p, 0) returns 0 and would hit the existing name_len == 0 error path, CONFIG_FORTIFY_SOURCE&#39;s fortified strnlen() first checks maxlen against __builtin_dynamic_object_size(). When Clang loses track of p&#39;s object size inside the loop, this triggers a BRK exception panic before the return value is examined.</p> <p>Add a buf_len == 0 guard at the loop entry to prevent calling fortified strnlen() on an exhausted buffer.</p> <p>Found by kernel fuzz testing through Xiaomi Smartphone.</p> https://vulnerability.circl.lu/vuln/cve-2026-46088