CVE-2026-98744: ASoC: codecs: max98363: fix uninitialized stream_config->type
ASoC: codecs: max98363: fix uninitialized streamconfig->type
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.113 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.56 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.10 - Configuration
Zero-initialize stream_config before passing it to sdw_stream_add_slave().
Linux kernel ASoC max98363 codec stream_config initialization = zero-initialize; type defaults to SDW_STREAM_PCM
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems running a Linux kernel with the MAX98363 ASoC codec driver and using the affected SoundWire stream setup path are exposed. The issue concerns an uninitialized stream configuration passed to sdw_stream_add_slave().
What condition triggers the vulnerability?
The issue is triggered when stream_config is used without initialization before it is passed to sdw_stream_add_slave(). Its type field can contain leftover memory data, which is subsequently copied into the SoundWire stream type.
What is the immediate mitigation if an updated kernel cannot be deployed?
The provided data identifies zero-initializing stream_config before calling sdw_stream_add_slave() as the corrective change, causing the type to default to SDW_STREAM_PCM. No configuration-only workaround or operational mitigation is provided.
How can I determine whether my kernel contains the fix?
Check whether the kernel source includes the MAX98363 driver change that zero-initializes stream_config before it is passed to sdw_stream_add_slave(). The listed stable-kernel references identify commits containing the fix.