Executive brief
A vulnerability was identified in the Linux kernel's sound subsystem (ASoC) specifically affecting Renesas R-Car audio hardware drivers. The issue involves a flaw in how the system handles internal lists of audio components, which could lead to an out-of-bounds memory access. In practice, this could cause system instability or a kernel crash, potentially impacting the availability of devices using this specific hardware configuration.
Technical details
An out-of-bounds (OOB) access vulnerability existed in the Renesas R-Car (rsnd) ASoC driver within the Linux kernel. The root cause was an insufficient boundary check in rsnd_probe() when iterating through the component_dais array. The loop relied on a zero-terminator that was not guaranteed if the array was fully populated up to RSND_MAX_COMPONENT. A local attacker could potentially trigger this OOB access during driver probing, leading to a kernel oops or memory corruption. The fix introduces an explicit check against RSND_MAX_COMPONENT in the loop condition to ensure the iterator stays within bounds.
Affected products
- Linux Linux Kernel 6.6 to 6.6.141, 6.12 to 6.12.91, 6.18 to 6.18.33, 7.0 to 7.0.10
Timeline
- 2026-03-27: disclosed: Initial patch submitted by Denis Rastyogin
- 2026-05-23: patched: Patch committed to stable trees
- 2026-07-19: advisory: NVD published the CVE record
References
- https://git.kernel.org/stable/c/134c61925e9e9ee0f4fdbab5c3984d5bb024f5f5
- https://git.kernel.org/stable/c/15e7b2ac2455995a6af02b9d3da7a432837aaf72
- https://git.kernel.org/stable/c/9f1daac27ca28e98c8c0e4450de42bb68d547250
- https://git.kernel.org/stable/c/a62b3e6e42359a79158c134e3cf5c74fe160c3f5
- https://git.kernel.org/stable/c/f9e437cddf6cf9e603bdaefe148c1f4792aaf39c