All vulnerabilities
CVE-2026-98053

Linux: ASoC: Intel: avs: Refactor and fix init_config access

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.12%Chance of exploitation activity in the next 30 days, higher than 1% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in70ffcaf86a053be99daaf3b103beac0ad7136ca3Also 75bd5ea9c858d89fb8862f23afb00783bf02cd7a, 8f20a0f4f7d638e83ae86db1719a24c7049762f5 and 1 moreCVE List
Published25 Sep 2026Updated 21 Oct 2026CVE List

What fixes it

  • 70ffcaf86a053be99daaf3b103beac0ad7136ca3LinuxCVE List
  • 75bd5ea9c858d89fb8862f23afb00783bf02cd7aLinuxCVE List
  • 8f20a0f4f7d638e83ae86db1719a24c7049762f5LinuxCVE List
  • 681e91035dc794896a904852040837190e5041f5LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

ASoC: Intel: avs: Refactor and fix init_config access

Existing code accesses enties found in ->init_configs array through indexes that are part of ->config_ids array. Those two are limited by: ->num_init_configs and ->num_config_ids respectively. Using ID larger or equal to ->num_init_configs leads to out-of-bounds access:

avs_path_module_send_init_configs() loop: (...) &acomp->tplg->init_configs[ids[i]] ^ out-of-bounds candidate

Rather than adding another if-statement, refactor the code. There is no need to store the IDs, have a list of pointers to actual config-entries instead. As the verification of ->init_config entries does not differ from verification of other types that are part of the topology.c file, simply reuse the code.

Text from CVE List

Affected versions 10

  • Linuxaffected: 8a49ef789b1be68242624d460df2ada8087308a7 before 70ffcaf86a053be99daaf3b103beac0ad7136ca3CVE List
  • Linuxaffected: 8a49ef789b1be68242624d460df2ada8087308a7 before 75bd5ea9c858d89fb8862f23afb00783bf02cd7aCVE List
  • Linuxaffected: 8a49ef789b1be68242624d460df2ada8087308a7 before 8f20a0f4f7d638e83ae86db1719a24c7049762f5CVE List
  • Linuxaffected: 8a49ef789b1be68242624d460df2ada8087308a7 before 681e91035dc794896a904852040837190e5041f5CVE List
  • Linuxaffected: 6.9CVE List
  • Linuxunaffected: all versions before 6.9CVE List
  • Linuxunaffected: 6.12.114 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 4