CVE-2026-74294

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture (ALSA) System on Chip (ASoC) meson audio interface unit (AIU) component. The AIU HDMI and internal codec mux put callbacks do not properly validate enum values before processing them. This allows an attacker to provide out-of-range enum values, which could lead to unexpected system behavior or a denial of service.

This vulnerability is rated Moderate rather than Important because exploitation requires local access with sound control device permissions on systems equipped with specific Amlogic Meson hardware, limiting the blast radius to a localized denial of service. The issue stems from missing boundary validation on enumeration values within the ASoC audio interface unit driver, which could trigger unexpected kernel states when malformed mixer control inputs are supplied. Standard enterprise server configurations do not utilize this specialized SoC audio subsystem, meaning typical Red Hat Enterprise Linux environments lack the physical hardware necessary to expose the vulnerable code path.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.