PT-2026-43956 · Opensuse+1 · Opensuse Tumbleweed+1
CVE-2026-46088
·
Published
2026-05-27
·
Updated
2026-07-31
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
openSUSE Tumbleweed versions prior to kernel-devel-7.0.11-1.1
Description
A flaw exists in the ALSA control component within the
snd ctl elem init enum names() function. The function advances a pointer p through a names buffer while decrementing the buf len variable. If buf len reaches zero while items still remain, the function calls strnlen(p, 0). When using CONFIG FORTIFY SOURCE, the fortified version of strnlen() checks the maximum length against the object size. If the compiler loses track of the object size of p during the loop, it triggers a BRK exception panic. This issue was identified through kernel fuzz testing on Xiaomi smartphones.Recommendations
Update the Linux kernel to a version where a guard for
buf len == 0 is added at the loop entry of the snd ctl elem init enum names() function.
Update openSUSE Tumbleweed to kernel-devel-7.0.11-1.1.Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux Kernel
Opensuse Tumbleweed