Live › vulnerability › CVE-2026-98744
Go to dashboardIn the Linux kernel's MAX98363 audio codec driver, a stream configuration structure was passed to the SoundWire layer without being zero-initialized, so its type field could hold garbage values. The fix zero-initializes the structure so the stream type defaults to PCM; the sources do not describe any attacker-controlled outcome.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only systems running a Linux kernel with the MAX98363 SoundWire amplifier driver loaded, typically laptops or embedded boards with that hardware. Servers and machines without this audio codec can skip it. The sources do not say whether an attacker can trigger the uninitialized value from outside the machine.
No product ranges from the sources yet.
sound/soc/codecs/max98363.c), for example with grep -i max98363 /boot/config-$(uname -r)uname -rstream_config in max98363 (version unknown from the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
ASoC: codecs: max98363: fix uninitialized stream_config->type
stream_config is not initialized before being passed to sdw_stream_add_slave(). The type field may contain garbage and is later copied to stream->type by sdw_config_stream().
Zero-initialize stream_config so type defaults to SDW_STREAM_PCM.
This page as .md · .json · in your agent: get_signal("CVE-2026-98744")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.