PT-2026-61155 · Linux · Linux

CVE-2026-63838 · Published 2026-07-19 · Updated 2026-07-19

Mitre

In the Linux kernel, the following vulnerability has been resolved:

ASoC: rsnd: Fix potential out-of-bounds access of component dais[]

component dais[RSND MAX COMPONENT] is initially zero-initialized and later populated in rsnd dai of node(). However, the existing boundary check: if (i >= RSND MAX COMPONENT)

does not guarantee that the last valid element remains zero. As a result, the loop can rely on component dais[RSND MAX COMPONENT] being zero, which may lead to an out-of-bounds access.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Related Identifiers

CVE-2026-63838

Affected Products

Linux

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-63838 · Security Note
• https://git.kernel.org/stable/c/15e7b2ac2455995a6af02b9d3da7a432837aaf72 · Note
• https://git.kernel.org/stable/c/a62b3e6e42359a79158c134e3cf5c74fe160c3f5 · Note
• https://git.kernel.org/stable/c/134c61925e9e9ee0f4fdbab5c3984d5bb024f5f5 · Note
• https://git.kernel.org/stable/c/f9e437cddf6cf9e603bdaefe148c1f4792aaf39c · Note
• https://git.kernel.org/stable/c/9f1daac27ca28e98c8c0e4450de42bb68d547250 · Note