CVE-2026-74333 - Vulnerability Details

- ASoC: amd: acp-sdw-legacy: Bound DAI link iteration

Description

In the Linux kernel, the following vulnerability has been resolved:

ASoC: amd: acp-sdw-legacy: Bound DAI link iteration

create_sdw_dailinks() walks soc_dais until it finds an entry with
initialised cleared, but soc_dais is allocated with exactly num_ends
entries. If all entries are initialised, the loop reads past the end of
the array.

This was reported by KASAN:

BUG: KASAN: slab-out-of-bounds in mc_probe+0x26b3/0x2774 [snd_acp_sdw_legacy_mach]
Read of size 1

Pass the allocated entry count to create_sdw_dailinks() and stop before
reading past the array.

Published: 2026-08-15

Score: 8.4 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability exists in the Linux kernel’s Advanced Sound Architecture (ASoC) driver for AMD ACP SDW legacy devices. A helper function, create_sdw_dailinks(), iterates over an array of Digital Audio Interface links without enforcing proper bounds checks, causing a read that can exceed the allocated array. This out‑of‑bounds read corrupts kernel memory and can lead to a kernel crash.

Affected Systems

All Linux kernel installations that include the ACP SDW legacy driver and have not incorporated the upstream fix are vulnerable. No specific kernel releases were enumerated in the advisory, so administrators should treat all versions prior to the patch commit as affected.

Risk and Exploitability

The likely attack vector is local; it requires the ability to trigger the driver’s probe routine, which can be achieved by loading the defective module or interacting with an audio device. The CVSS score of 8.4 indicates a high‑severity issue. The EPSS score of <1% and its absence from CISA’s KEV catalog suggest limited public exploitation evidence, yet the vulnerability remains significant for targeted attacks.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`2981d9b0789c44b7375e7d599caf71bd843afc9e`	affected	< 1279bdab5fa1f28c168e54215db506e87c6fac1e
`2981d9b0789c44b7375e7d599caf71bd843afc9e`	affected	< 0230471eef5902207516851dcd47c559571dded2
`2981d9b0789c44b7375e7d599caf71bd843afc9e`	affected	< d49ecdf327cc91062d2f80996a163cf65fda1e60

Linux

affected

Version	Status	Constraints
`6.13`	affected	—
`0`	unaffected	< 6.13
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[2981d9b0789c44b7375e7d599caf71bd843afc9e,1279bdab5fa1f28c168e54215db506e87c6fac1e)`	affected	code_commit	—
`[2981d9b0789c44b7375e7d599caf71bd843afc9e,0230471eef5902207516851dcd47c559571dded2)`	affected	code_commit	—
`[2981d9b0789c44b7375e7d599caf71bd843afc9e,d49ecdf327cc91062d2f80996a163cf65fda1e60)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.13`	affected	generic	—
`[0,6.13)`	unaffected	generic	—
`[6.18.40,7.0.0)`	unaffected	semver	—
`[7.1.5,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a version that contains the upstream patch for the ACP SDW legacy driver
Apply any vendor backported patches specifically for the ACP SDW legacy driver if available
If a quick update is not possible, disable or unload the affected sound module to prevent the state that triggers the out‑of‑bounds read

Generated by OpenCVE AI on August 17, 2026 at 13:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00142.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0230471eef5902207516851dcd47c559571dded2
https://git.kernel.org/stable/c/1279bdab5fa1f28c168e54215db506e87c6fac1e
https://git.kernel.org/stable/c/d49ecdf327cc91062d2f80996a163cf65fda1e60
https://lore.kernel.org/linux-cve-announce/2026081556-CVE-2026-74333-6d02@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74333
https://www.cve.org/CVERecord?id=CVE-2026-74333

History

Fri, 21 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026081556-CVE-2026-74333-6d02@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74333 https://www.cve.org/CVERecord?id=CVE-2026-74333
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 17 Aug 2026 13:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125

Mon, 17 Aug 2026 10:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-787

Mon, 17 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 15 Aug 2026 17:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-787

Sat, 15 Aug 2026 06:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: acp-sdw-legacy: Bound DAI link iteration create_sdw_dailinks() walks soc_dais until it finds an entry with initialised cleared, but soc_dais is allocated with exactly num_ends entries. If all entries are initialised, the loop reads past the end of the array. This was reported by KASAN: BUG: KASAN: slab-out-of-bounds in mc_probe+0x26b3/0x2774 [snd_acp_sdw_legacy_mach] Read of size 1 Pass the allocated entry count to create_sdw_dailinks() and stop before reading past the array.
Title		ASoC: amd: acp-sdw-legacy: Bound DAI link iteration
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0230471eef5902207516851dcd47c559571dded2 https://git.kernel.org/stable/c/1279bdab5fa1f28c168e54215db506e87c6fac1e https://git.kernel.org/stable/c/d49ecdf327cc91062d2f80996a163cf65fda1e60

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:58:25.781Z

Updated: 2026-08-17T05:46:00.787Z

Reserved: 2026-08-15T05:44:03.885Z

Link: CVE-2026-74333

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:22:34.167

Modified: 2026-08-17T06:19:27.787

Link: CVE-2026-74333

Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-74333 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-17T13:15:04Z

Weaknesses

CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object