CVE-2026-74295

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: hdac_hdmi: Validate written enum value hdac_hdmi_set_pin_port_mux() uses the written enum value to index the texts array before calling snd_soc_dapm_put_enum_double(), which validates that the value is within the enum item range. An out-of-range value can therefore make the driver read past the texts array before the helper rejects the write. Move the lookup after the helper has accepted the value.

CVSS v3 7.1 HIGH

7.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/0b08baeccdcf52fad328ad645f5b4fbee04eea34
https://git.kernel.org/stable/c/216336418c007c4b44c650acf2fd3d2de5bb81e8
https://git.kernel.org/stable/c/7f02e9064b6f84e7f93c72f134306271eb4f7de4
https://git.kernel.org/stable/c/8cbf24714d6b3f553fc959632c9781176a73a9a7
https://git.kernel.org/stable/c/9131e4b023e0db5764680034bdc94aeae0b0f33d
https://git.kernel.org/stable/c/bc464a6a9e352daa17b1636c090cf3185710b9a0
https://git.kernel.org/stable/c/d8961b5c7889b6ecc00f1409d36826df1665df27

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-15 06:22

Updated : 2026-08-17 06:19

NVD link : CVE-2026-74295

Mitre link : CVE-2026-74295

CVE.ORG link : CVE-2026-74295

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-74295", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4a3478debf36c0aa0cf0860daec245b13cd4448f", "lessThan": "216336418c007c4b44c650acf2fd3d2de5bb81e8", "versionType": "git"}, {"status": "affected", "version": "4a3478debf36c0aa0cf0860daec245b13cd4448f", "lessThan": "bc464a6a9e352daa17b1636c090cf3185710b9a0", "versionType": "git"}, {"status": "affected", "version": "4a3478debf36c0aa0cf0860daec245b13cd4448f", "lessThan": "8cbf24714d6b3f553fc959632c9781176a73a9a7", "versionType": "git"}, {"status": "affected", "version": "4a3478debf36c0aa0cf0860daec245b13cd4448f", "lessThan": "7f02e9064b6f84e7f93c72f134306271eb4f7de4", "versionType": "git"}, {"status": "affected", "version": "4a3478debf36c0aa0cf0860daec245b13cd4448f", "lessThan": "9131e4b023e0db5764680034bdc94aeae0b0f33d", "versionType": "git"}, {"status": "affected", "version": "4a3478debf36c0aa0cf0860daec245b13cd4448f", "lessThan": "d8961b5c7889b6ecc00f1409d36826df1665df27", "versionType": "git"}, {"status": "affected", "version": "4a3478debf36c0aa0cf0860daec245b13cd4448f", "lessThan": "0b08baeccdcf52fad328ad645f5b4fbee04eea34", "versionType": "git"}], "programFiles": ["sound/soc/codecs/hdac_hdmi.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.6"}, {"status": "unaffected", "version": "0", "lessThan": "4.6", "versionType": "semver"}, {"status": "unaffected", "version": "5.15.212", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.178", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.145", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.97", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.40", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.5", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["sound/soc/codecs/hdac_hdmi.c"], "defaultStatus": "affected"}]}], "published": "2026-08-15T06:22:29.097", "references": [{"url": "https://git.kernel.org/stable/c/0b08baeccdcf52fad328ad645f5b4fbee04eea34", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/216336418c007c4b44c650acf2fd3d2de5bb81e8", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/7f02e9064b6f84e7f93c72f134306271eb4f7de4", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/8cbf24714d6b3f553fc959632c9781176a73a9a7", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/9131e4b023e0db5764680034bdc94aeae0b0f33d", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/bc464a6a9e352daa17b1636c090cf3185710b9a0", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/d8961b5c7889b6ecc00f1409d36826df1665df27", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: codecs: hdac_hdmi: Validate written enum value\n\nhdac_hdmi_set_pin_port_mux() uses the written enum value to index the\ntexts array before calling snd_soc_dapm_put_enum_double(), which validates\nthat the value is within the enum item range.\n\nAn out-of-range value can therefore make the driver read past the texts\narray before the helper rejects the write. Move the lookup after the helper\nhas accepted the value."}], "lastModified": "2026-08-17T06:19:23.553", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}