CVE-2026-98263

A flaw was found in the Linux kernel's Realtek RT712 audio codec driver. A local user could exploit this flaw to cause a Denial of Service (DoS) or unexpected system behavior. The issue arises because audio stream configuration data is left uninitialized before being passed to the SoundWire subsystem, causing invalid configuration values to be processed.

Red Hat rates the impact of this flaw as low. A flaw was found in the Linux kernel ASoC driver for the Realtek RT712 SDCA DMIC audio codec, in which the stream_config structure was not initialized before being passed to sdw_stream_add_slave(). The uninitialized type field could contain garbage data that was later copied into the SoundWire stream state by sdw_config_stream(). A local user with access to the affected ALSA PCM device could use this flaw to cause a denial of service of the audio stream or other unexpected system behavior; there is no impact on confidentiality or integrity. Affected products are the Red Hat Enterprise Linux 8, 9, and 10 streams that contain the RT712 SDCA driver (introduced in RHEL 8.9 and RHEL 9.3), Red Hat In-Vehicle OS 2, and OpenShift Container Platform releases shipping a RHEL 9 based CoreOS kernel. RHEL 6, RHEL 7, RHEL 8.4/8.6/8.8, and RHEL 9.2 streams, and OpenShift Container Platform releases based on RHEL CoreOS 8, are not affected because the vulnerable code is not present in those kernels. The fix for the affected streams has been deferred because the flaw is of low severity, exploitation requires local access to a system with the specific RT712 SDCA DMIC hardware, and the demonstrated impact is limited to availability loss of the affected audio stream; the residual risk of deferring the fix is therefore considered low. While the CVSS:3.1 base score is 5.5 (MODERATE), the overall Red Hat impact is rated LOW because the practical impact is confined to the audio subsystem on specific hardware, with no supported information disclosure, memory corruption, or privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.