FKIE_CVE-2026-98053

Vulnerability from fkie_nvd - Published: 2026-09-25 11:17 - Updated: 2026-09-25 11:17
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Refactor and fix init_config access Existing code accesses enties found in ->init_configs array through indexes that are part of ->config_ids array. Those two are limited by: ->num_init_configs and ->num_config_ids respectively. Using ID larger or equal to ->num_init_configs leads to out-of-bounds access: avs_path_module_send_init_configs() loop: (...) &acomp->tplg->init_configs[ids[i]] ^ out-of-bounds candidate Rather than adding another if-statement, refactor the code. There is no need to store the IDs, have a list of pointers to actual config-entries instead. As the verification of ->init_config entries does not differ from verification of other types that are part of the topology.c file, simply reuse the code.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/681e91035dc794896a904852040837190e5041f5
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/75bd5ea9c858d89fb8862f23afb00783bf02cd7a
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/8f20a0f4f7d638e83ae86db1719a24c7049762f5
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/soc/intel/avs/path.c",
            "sound/soc/intel/avs/topology.c",
            "sound/soc/intel/avs/topology.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "75bd5ea9c858d89fb8862f23afb00783bf02cd7a",
              "status": "affected",
              "version": "8a49ef789b1be68242624d460df2ada8087308a7",
              "versionType": "git"
            },
            {
              "lessThan": "8f20a0f4f7d638e83ae86db1719a24c7049762f5",
              "status": "affected",
              "version": "8a49ef789b1be68242624d460df2ada8087308a7",
              "versionType": "git"
            },
            {
              "lessThan": "681e91035dc794896a904852040837190e5041f5",
              "status": "affected",
              "version": "8a49ef789b1be68242624d460df2ada8087308a7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/soc/intel/avs/path.c",
            "sound/soc/intel/avs/topology.c",
            "sound/soc/intel/avs/topology.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: Intel: avs: Refactor and fix init_config access\n\nExisting code accesses enties found in -\u003einit_configs array through\nindexes that are part of -\u003econfig_ids array.  Those two are limited by:\n-\u003enum_init_configs and -\u003enum_config_ids respectively.  Using ID larger\nor equal to -\u003enum_init_configs leads to out-of-bounds access:\n\navs_path_module_send_init_configs()\nloop:\n\t(...) \u0026acomp-\u003etplg-\u003einit_configs[ids[i]]\n\t\t\t\t\t^ out-of-bounds candidate\n\nRather than adding another if-statement, refactor the code.  There is no\nneed to store the IDs, have a list of pointers to actual config-entries\ninstead.  As the verification of -\u003einit_config entries does not differ from\nverification of other types that are part of the topology.c file, simply\nreuse the code."
    }
  ],
  "id": "CVE-2026-98053",
  "lastModified": "2026-09-25T11:17:34.227",
  "metrics": {},
  "published": "2026-09-25T11:17:34.227",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/681e91035dc794896a904852040837190e5041f5"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/75bd5ea9c858d89fb8862f23afb00783bf02cd7a"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/8f20a0f4f7d638e83ae86db1719a24c7049762f5"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.