CVE-2026-93280

A flaw was found in the Linux kernel's Greybus audio subsystem. An attacker connecting a malicious Greybus device can trigger a Denial of Service (DoS) or unauthorized information disclosure by providing a crafted audio topology descriptor. Because the driver fails to verify that internal section sizes fit within the allocated buffer, parsing the descriptor leads to an out-of-bounds read.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.