CVE-2026-98053: ASoC: Intel: avs: Refactor and fix init_config access
In the Linux kernel, the following vulnerability has been resolved:
ASoC: Intel: avs: Refactor and fix initconfig access
Existing code accesses enties found in ->initconfigs array through indexes that are part of ->configids array. Those two are limited by: ->numinitconfigs and ->numconfigids respectively. Using ID larger or equal to ->numinitconfigs leads to out-of-bounds access:
avspathmodulesendinitconfigs() loop: (...) &acomp->tplg->initconfigs[ids[i]] ^ out-of-bounds candidate
Rather than adding another if-statement, refactor the code. There is no need to store the IDs, have a list of pointers to actual config-entries instead. As the verification of ->initconfig entries does not differ from verification of other types that are part of the topology.c file, simply reuse the code.
Affected Software
Event History
Frequently Asked Questions
What condition triggers the out-of-bounds access?
The issue can occur when a value in the config_ids array is greater than or equal to num_init_configs. The affected loop uses that ID to index the init_configs array, even though config_ids and init_configs are bounded by different counts.
Which component is involved?
The vulnerable access is in the Linux kernel's ASoC Intel AVS code, specifically avs_path_module_send_init_configs().
How was the issue addressed?
The fix refactors the code so it stores pointers to the actual initialization configuration entries rather than IDs used as indexes. It also reuses existing topology entry validation logic for init_config entries.