The Linux kernel ASoC driver for the max98363 codec contains a logic error where a configuration structure is used before it is initialized. The stream_config->type field may contain arbitrary data, which is subsequently copied into the stream type field. This can lead to an audio stream being configured with an incorrect type, potentially resulting in driver misbehavior or a denial of service to audio consumers. After the fix, type defaults to SDW_STREAM_PCM.

All Linux kernel builds that include the ASoC max98363 driver are affected, including any vendor‑supplied kernels that have not applied the patch commit. Any kernel version prior to the published fix is considered vulnerable.

The likely attack vector is any user who initiates audio streaming on a device using the max98363 codec. The uninitialized variable creates a logic flaw that could allow the audio subsystem to be misconfigured, potentially leading to incorrect audio output or denial of service. The CVSS score is 5.5, EPSS <1%, and the issue is not listed in the CISA KEV catalog, indicating a moderate risk exposure. Active exploitation has not been reported, but the fix zero‑initializes the structure, eliminating the undefined behaviour.