CVE-2026-31778

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: caiaq: fix stack out-of-bounds read in init_card

The loop creates a whitespace-stripped copy of the card shortname

where `len < sizeof(card->id)` is used for the bounds check. Since

sizeof(card->id) is 16 and the local id buffer is also 16 bytes,

writing 16 non-space characters fills the entire buffer,

overwriting the terminating nullbyte.

When this non-null-terminated string is later passed to

snd_card_set_id() -> copy_valid_id_string(), the function scans

forward with `while (*nid && ...)` and reads past the end of the

stack buffer, reading the contents of the stack.

A USB device with a product name containing many non-ASCII, non-space

characters (e.g. multibyte UTF-8) will reliably trigger this as follows:

BUG: KASAN: stack-out-of-bounds in copy_valid_id_string

sound/core/init.c:696 [inline]

BUG: KASAN: stack-out-of-bounds in snd_card_set_id_no_lock+0x698/0x74c

sound/core/init.c:718

The

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References