{"id":"CVE-2026-98744","kind":"vulnerability","aliases":["CVE-2026-98744"],"related":[],"title":"Linux kernel: uninitialized SoundWire stream config in MAX98363 audio codec driver","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: codecs: max98363: fix uninitialized stream_config->type\n\nstream_config is not initialized before being passed to\nsdw_stream_add_slave().  The type field may contain garbage and is\nlater copied to stream->type by sdw_config_stream().\n\nZero-initialize stream_config so type defaults to SDW_STREAM_PCM.","summary":"In the Linux kernel's MAX98363 audio codec driver, a stream configuration structure was passed to the SoundWire layer without being zero-initialized, so its type field could hold garbage values. The fix zero-initializes the structure so the stream type defaults to PCM; the sources do not describe any attacker-controlled outcome.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","infrastructure","laptops","linux-kernel","soundwire"],"not_affected_if":["driver-not-loaded","no-max98363-hardware"],"how_to_check":"- Check whether the kernel source or build includes the MAX98363 codec driver (`sound/soc/codecs/max98363.c`), for example with `grep -i max98363 /boot/config-$(uname -r)`\n- Compare the running kernel with the fixed version listed in the upstream NVD/kernel.org commit: `uname -r`","fix":"- Update the Linux kernel to a release that includes the upstream commit zeroing `stream_config` in max98363 (version unknown from the sources)\n- Vendor kernels: apply the stable backport for your branch once your distribution publishes it","status":"open","published_at":"2026-10-18T16:17:28+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:17:02+00:00","updated_at":"2026-10-25T05:17:02+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:17:02Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit zeroing `stream_config` in max98363 (version unknown from the sources)\n- Vendor kernels: apply the stable backport for your branch once your distribution publishes it","reach":"local","title":"Linux kernel: uninitialized SoundWire stream config in MAX98363 audio codec driver","impact":"low","summary":"In the Linux kernel's MAX98363 audio codec driver, a stream configuration structure was passed to the SoundWire layer without being zero-initialized, so its type field could hold garbage values. The fix zero-initializes the structure so the stream type defaults to PCM; the sources do not describe any attacker-controlled outcome.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","laptops","embedded","soundwire"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; sources describe only an uninitialized field","analyst_note":"Check the NVD entry and the upstream kernel.org commit for the fixed kernel versions and any exploit impact.","how_to_check":"- Check whether the kernel source or build includes the MAX98363 codec driver (`sound/soc/codecs/max98363.c`), for example with `grep -i max98363 /boot/config-$(uname -r)`\n- Compare the running kernel with the fixed version listed in the upstream NVD/kernel.org commit: `uname -r`","needs_analyst":true,"not_affected_if":["no-max98363-hardware","driver-not-loaded"],"who_is_affected":"Only systems running a Linux kernel with the MAX98363 SoundWire amplifier driver loaded, typically laptops or embedded boards with that hardware. Servers and machines without this audio codec can skip it. The sources do not say whether an attacker can trigger the uninitialized value from outside the machine.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000677,"input_tokens":3354,"output_tokens":684,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98744':14A,17A 'add':110C 'asoc':91C 'attack':78B 'attacker-control':77B 'audio':9A,31B 'codec':10A,32B,92C 'config':6A,97C,100C,127C,133C 'configur':36B 'contain':116C 'control':79B 'copi':121C 'could':53B 'cve':12A,15A 'default':68B,136C 'describ':75B 'driver':11A,33B 'embed':18B 'field':52B,114C 'fix':58B,94C 'follow':86C 'garbag':55B,117C 'hold':54B 'infrastructur':19B 'initi':48B,61B,103C,131C 'kernel':2A,23B,28B,84C 'laptop':20B 'later':120C 'layer':43B 'linux':1A,22B,27B,83C 'linux-kernel':21B 'max98363':8A,30B,93C 'may':115C 'outcom':80B 'pass':39B,106C 'pcm':70B,140C 'resolv':90C 'sdw':108C,126C,138C 'slave':111C 'soundwir':4A,24B,42B 'sourc':72B 'stream':5A,35B,66B,96C,99C,109C,123C,128C,132C,139C 'structur':37B,63B 'type':51B,67B,98C,113C,124C,135C 'uniniti':3A,95C 'valu':56B 'vulner':87C 'without':44B 'zero':47B,60B,130C 'zero-initi':46B,59B,129C","nicknames":[],"mitigations":[],"who_affected":"Only systems running a Linux kernel with the MAX98363 SoundWire amplifier driver loaded, typically laptops or embedded boards with that hardware. Servers and machines without this audio codec can skip it. The sources do not say whether an attacker can trigger the uninitialized value from outside the machine.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:28+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98744","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98744","severity":null,"published_at":"2026-10-18T16:17:28+00:00","modified_at":"2026-10-21T13:21:42+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}