CVE-2026-74291

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ASoC: topology: Check PCM and DAI name strings before use

Topology objects store several PCM and DAI names in fixed-size UAPI

arrays. Other topology parser paths validate these fields with bounded

strnlen() checks before using them as C strings, but the PCM and DAI

paths still pass some fixed-size arrays directly to strlen(),

devm_kstrdup(), DAI lookup, and diagnostic prints.

A malformed topology blob with a non-NUL-terminated PCM, DAI, or stream

capability name can therefore make the parser read past the end of the

fixed-size field.

Reject unterminated PCM and DAI name fields before consuming them as C

strings.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References