CVE-2026-74291

A flaw was found in the Linux kernel's ASoC (Audio System on Chip) topology component. This vulnerability allows a local attacker to provide a specially crafted, malformed audio topology configuration (blob) with non-NUL-terminated name strings. This can cause the parser to read beyond the intended memory boundary, potentially leading to an out-of-bounds read and information disclosure.

This vulnerability is rated as Moderate because exploitation requires local access and the ability to load crafted audio topology configurations, limiting the potential blast radius to a local denial of service or out-of-bounds memory read rather than arbitrary code execution. In typical Red Hat Enterprise Linux deployments, audio hardware utilizing the ALSA System on Chip framework is absent or unused, substantially reducing the practical attack surface. Additionally, supplying customized topology definitions generally requires administrative privileges or direct access to specific sound device nodes.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.