CVE-2026-74291: ASoC: topology: Check PCM and DAI name strings before use

Q: What is the severity of CVE-2026-74291?

The severity of CVE-2026-74291 is rated at 23.

Q: How do I fix CVE-2026-74291?

To fix CVE-2026-74291, ensure that your Linux kernel is updated to a patched version that includes the necessary bounds checking for PCM and DAI name strings.

Q: Are there any known exploits for CVE-2026-74291?

As of now, there are no publicly disclosed exploits for CVE-2026-74291.

Q: Which versions of the Linux kernel are affected by CVE-2026-74291?

CVE-2026-74291 affects specific versions of the Linux kernel that have not implemented the required validation checks for PCM and DAI name strings.

Q: What are the potential impacts of CVE-2026-74291?

The potential impacts of CVE-2026-74291 include undefined behavior in the ASoC topology handling, which could lead to system instability or security vulnerabilities.

Published Aug 15, 2026

Updated

ASoC: topology: Check PCM and DAI name strings before use

Affected Software

259 affected componentsFixes available

Linux Linux kernel

Microsoft azl3 kernel 6.6.157.1-1<6.6.158.1-1

6.6.158.1-1

ubuntu/linux-azure*

ubuntu/linux-aws-hwe*

ubuntu/linux-azure*

ubuntu/linux-gcp*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-oracle*

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-aws-5.4*

ubuntu/linux-azure*

ubuntu/linux-azure-4.15*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-5.4*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-4.15*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gcp-5.4*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-5.4*

ubuntu/linux-hwe-edge*

ubuntu/linux-ibm-5.4*

ubuntu/linux-kvm*

ubuntu/linux-oem*

ubuntu/linux-oracle*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-oracle-5.4*

ubuntu/linux-raspi-5.4*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.15*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.15*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-azure-fde-5.15*

ubuntu/linux-bluefield*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.15*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.15*

ubuntu/linux-hwe-5.8*

ubuntu/linux-ibm*

ubuntu/linux-ibm-5.15*

ubuntu/linux-intel-5.13*

ubuntu/linux-intel-iotg-5.15*

ubuntu/linux-iot*

ubuntu/linux-kvm*

ubuntu/linux-lowlatency-hwe-5.15*

ubuntu/linux-nvidia-tegra-5.15*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.15*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.15*

ubuntu/linux-riscv-5.8*

ubuntu/linux-xilinx-zynqmp*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux*

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws*

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-aws-6.8*

ubuntu/linux-azure*

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-6.8*

ubuntu/linux-azure-fde*

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-azure-fde-6.8*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-gcp-6.8*

ubuntu/linux-gke*

ubuntu/linux-gkeop*

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-ibm*

ubuntu/linux-ibm-6.8*

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-intel-iotg*

ubuntu/linux-kvm*

ubuntu/linux-lowlatency*

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-lowlatency-hwe-6.8*

ubuntu/linux-nvidia*

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-nvidia-6.8*

ubuntu/linux-nvidia-tegra*

ubuntu/linux-nvidia-tegra-igx*

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle*

ubuntu/linux-oracle-6.5*

ubuntu/linux-oracle-6.8*

ubuntu/linux-raspi*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-riscv-6.8*

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-xilinx-zynqmp*

ubuntu/linux-bluefield*

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-realtime*

ubuntu/linux-realtime-6.8*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-aws-6.14*

ubuntu/linux-aws-6.17*

ubuntu/linux-aws-7.0<7.0.0-1014.14~24.04.1

7.0.0-1014.14~24.04.1

ubuntu/linux-azure*

ubuntu/linux-azure-6.11*

ubuntu/linux-azure-6.14*

ubuntu/linux-azure-6.17*

ubuntu/linux-azure-7.0<7.0.0-1017.17~24.04.1

7.0.0-1017.17~24.04.1

ubuntu/linux-azure-fde*

ubuntu/linux-azure-fde-6.14*

ubuntu/linux-azure-fde-6.17*

ubuntu/linux-azure-fde-7.0<7.0.0-1016.16~24.04.1

7.0.0-1016.16~24.04.1

ubuntu/linux-azure-nvidia*

ubuntu/linux-azure-nvidia-6.14*

ubuntu/linux-gcp*

ubuntu/linux-gcp-6.11*

ubuntu/linux-gcp-6.14*

ubuntu/linux-gcp-7.0<7.0.0-1014.14~24.04.1

7.0.0-1014.14~24.04.1

ubuntu/linux-gke*

ubuntu/linux-gkeop*

ubuntu/linux-hwe-6.11*

ubuntu/linux-hwe-6.14*

ubuntu/linux-hwe-6.17*

ubuntu/linux-hwe-7.0<7.0.0-38.38~24.04.4

7.0.0-38.38~24.04.4

ubuntu/linux-ibm*

ubuntu/linux-lowlatency*

ubuntu/linux-lowlatency-hwe-6.11*

ubuntu/linux-nvidia*

ubuntu/linux-nvidia-6.11*

ubuntu/linux-nvidia-6.17*

ubuntu/linux-nvidia-7.0*

ubuntu/linux-nvidia-lowlatency*

ubuntu/linux-nvidia-tegra*

ubuntu/linux-oem-6.11*

ubuntu/linux-oem-6.14*

ubuntu/linux-oem-6.17*

ubuntu/linux-oem-6.8*

ubuntu/linux-oracle*

ubuntu/linux-oracle-6.14*

ubuntu/linux-oracle-6.17*

ubuntu/linux-oracle-7.0<7.0.0-1013.13~24.04.1

7.0.0-1013.13~24.04.1

ubuntu/linux-raspi*

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-6.14*

ubuntu/linux-riscv-6.17*

ubuntu/linux-riscv-7.0<7.0.0-38.38.1~24.04.1

7.0.0-38.38.1~24.04.1

ubuntu/linux-xilinx*

ubuntu/linux-bluefield*

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-realtime-6.14*

ubuntu/linux-realtime-6.17*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux<7.0.0-38.38

7.0.0-38.38

ubuntu/linux-aws<7.0.0-1014.14

7.0.0-1014.14

ubuntu/linux-azure<7.0.0-1017.17

7.0.0-1017.17

ubuntu/linux-azure-fde<7.0.0-1016.16

7.0.0-1016.16

ubuntu/linux-gcp<7.0.0-1014.14

7.0.0-1014.14

ubuntu/linux-gke<7.0.0-1008.9

7.0.0-1008.9

ubuntu/linux-ibm<7.0.0-1015.15

7.0.0-1015.15

ubuntu/linux-nvidia*

ubuntu/linux-nvidia-bos*

ubuntu/linux-oem-7.0<7.0.0-1015.15

7.0.0-1015.15

ubuntu/linux-oracle<7.0.0-1013.13

7.0.0-1013.13

ubuntu/linux-raspi*

ubuntu/linux-realtime<7.0.0-38.38.1

7.0.0-38.38.1

ubuntu/linux-riscv<7.0.0-38.38.1

7.0.0-38.38.1

debian/linux*

debian/linux<6.12.111-1

6.12.111-1

debian/linux<7.1.5-1

7.1.5-1

debian/linux-6.12<6.12.111-1~deb12u1

6.12.111-1~deb12u1

linux/kernel>=4.6.0<6.1.191

6.1.191

linux/kernel>=6.2.0<6.6.158

6.6.158

linux/kernel>=6.7.0<6.12.111

6.12.111

linux/kernel>=6.13.0<6.18.53

6.18.53

linux/kernel>=6.19.0<7.1.5

7.1.5

debian/linux<=6.1.176-1, <=6.1.190-1, <=6.12.107-1

6.12.115-27.2.12-17.2.15-1

debian/linux-6.12

6.12.113-1~deb12u1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.158.1-1
Upgrade
Upgrade ubuntu/linux-aws-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1014.14~24.04.1
Upgrade
Upgrade ubuntu/linux-azure-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1017.17~24.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1016.16~24.04.1
Upgrade
Upgrade ubuntu/linux-gcp-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1014.14~24.04.1
Upgrade
Upgrade ubuntu/linux-hwe-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-38.38~24.04.4
Upgrade
Upgrade ubuntu/linux-oracle-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1013.13~24.04.1
Upgrade
Upgrade ubuntu/linux-riscv-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-38.38.1~24.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 7.0.0-38.38
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 7.0.0-1014.14
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 7.0.0-1017.17
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 7.0.0-1016.16
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 7.0.0-1014.14
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 7.0.0-1008.9
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 7.0.0-1015.15
Upgrade
Upgrade ubuntu/linux-oem-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1015.15
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 7.0.0-1013.13
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 7.0.0-38.38.1
Upgrade
Upgrade ubuntu/linux-riscv to a version that resolves this vulnerability.
Fixed in 7.0.0-38.38.1
Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 6.12.111-1
Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 7.1.5-1
Upgrade
Upgrade debian/linux-6.12 to a version that resolves this vulnerability.
Fixed in 6.12.111-1~deb12u1
Upgrade
Upgrade linux/Kernel to a version that resolves this vulnerability.
Fixed in 6.1.191
Upgrade
Upgrade linux/Kernel to a version that resolves this vulnerability.
Fixed in 6.6.158
Upgrade
Upgrade linux/Kernel to a version that resolves this vulnerability.
Fixed in 6.12.111
Upgrade
Upgrade linux/Kernel to a version that resolves this vulnerability.
Fixed in 6.18.53
Upgrade
Upgrade linux/Kernel to a version that resolves this vulnerability.
Fixed in 7.1.5
Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
Upgrade
Upgrade debian/linux-6.12 to a version that resolves this vulnerability.
Fixed in 6.12.113-1~deb12u1
Compensating control
In the ASoC topology parser, reject PCM, DAI, and stream capability name fields that are not NUL-terminated before consuming them as C strings or using them for lookup, duplication, or diagnostic output.

Event History

Aug 15, 2026

CVE Published

via MITRE·05:57 AM

Data Sourced

via MITRE·05:57 AM

Description

Data Sourced

via OSV·05:57 AM

DescriptionAffected Software

Data Sourced

via OSV·06:22 AM

Severity

Data Sourced

via NVD·06:22 AM

Description

Sep 23, 2026

Data Sourced

via Microsoft·08:57 AM

DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

DSA-6528

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-4817-1

Frequently Asked Questions

What is the severity of CVE-2026-74291?

The severity of CVE-2026-74291 is rated at 23.

How do I fix CVE-2026-74291?

To fix CVE-2026-74291, ensure that your Linux kernel is updated to a patched version that includes the necessary bounds checking for PCM and DAI name strings.

Are there any known exploits for CVE-2026-74291?

As of now, there are no publicly disclosed exploits for CVE-2026-74291.

Which versions of the Linux kernel are affected by CVE-2026-74291?

CVE-2026-74291 affects specific versions of the Linux kernel that have not implemented the required validation checks for PCM and DAI name strings.

What are the potential impacts of CVE-2026-74291?

The potential impacts of CVE-2026-74291 include undefined behavior in the ASoC topology handling, which could lead to system instability or security vulnerabilities.

CVE-2026-74291: ASoC: topology: Check PCM and DAI name strings before use

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2026-74291?

How do I fix CVE-2026-74291?

Are there any known exploits for CVE-2026-74291?

Which versions of the Linux kernel are affected by CVE-2026-74291?

What are the potential impacts of CVE-2026-74291?

Company

Resources

Contact