CVE-2026-74332

A flaw was found in the Linux kernel's ASoC (Advanced Linux Sound Architecture System on Chip) AMD ACP SoundWire (SDW) SOF (Sound Open Firmware) driver. The create_sdw_dailinks() function, responsible for iterating through DAI (Digital Audio Interface) links, does not properly bound its iteration. This oversight could allow the function to read past the end of an allocated array, potentially leading to system instability or denial of service.

This vulnerability is rated as Moderate impact because exploitation is constrained to local access and requires the presence of specific AMD SoundWire audio hardware, limiting the blast radius primarily to a local denial of service. The out-of-bounds memory read takes place during digital audio interface setup in the sound subsystem, potentially inducing a kernel crash. Standard enterprise server deployments and systems without the corresponding AMD Sound Open Firmware audio controllers do not initialize this driver and remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.