CVE-2026-74295
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In the Linux kernel, the ASoC codec driver hdac_hdmi has a vulnerability due to lack of validation of the enum value before using it as an index into the texts array. hdac_hdmi_set_pin_port_mux() uses the enum value to index the array before calling snd_soc_dapm_put_enum_double(), which validates the range. An out-of-range value can cause an out-of-bounds read. The fix moves the lookup after the helper has accepted the value.
Risk Assessment
A local user with audio control privileges could cause an out-of-bounds read of kernel memory, potentially leading to information disclosure or a crash.
Recommendation
Update the Linux kernel to a version with the fix for CVE-2026-74295. Restrict access to audio interfaces for unauthorized users.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: hdac_hdmi: Validate written enum value hdac_hdmi_set_pin_port_mux() uses the written enum value to index the texts array before calling snd_soc_dapm_put_enum_double(), which validates that the value is within the enum item range. An out-of-range value can therefore make the driver read past the texts array before the helper rejects the write. Move the lookup after the helper has accepted the value.