CVE-2026-31619

A flaw was found in the Linux kernel's ALSA fireworks driver. A malicious firewire device could supply a specially crafted status value, causing an out-of-bounds read during a string array lookup. This vulnerability may lead to a denial of service (DoS) or potentially information disclosure.

FireWire Echo Audio fireworks status indices are now bounded before table lookup, closing OOB read from a malicious device. Red Hat recommends patched kernels when FireWire audio is exposed; unload snd_fireworks if unused.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the snd_fireworks module from being loaded. See https://access.redhat.com/solutions/41278 for instructions.