CVE-2026-63838 Details
Description
In the Linux kernel, the following vulnerability has been resolved: ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] component_dais[RSND_MAX_COMPONENT] is initially zero-initialized and later populated in rsnd_dai_of_node(). However, the existing boundary check: if (i >= RSND_MAX_COMPONENT) does not guarantee that the last valid element remains zero. As a result, the loop can rely on component_dais[RSND_MAX_COMPONENT] being zero, which may lead to an out-of-bounds access. Found by Linux Verification Center (linuxtesting.org) with SVACE.
A potential out-of-bounds access vulnerability has been identified in the Linux kernel's ASoC (ALSA System on Chip) rsnd component, specifically within the Renesas R-Car audio driver. This issue arises because the 'component_dais' array, which is used to manage audio data interfaces, is initially zero-initialized and later populated by the 'rsnd_dai_of_node()' function. The existing boundary check fails to ensure that the last valid element of the array remains zero, allowing the possibility for the loop to incorrectly assume that 'component_dais[RSND_MAX_COMPONENT]' is zero. This flaw can lead to out-of-bounds access, potentially causing memory corruption or other unintended behavior.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. The commit that addresses this issue is available in the Linux kernel stable tree.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No CVSS 3.x data is available for this CVE.
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
No weakness enumeration is available for this CVE.
Affected Products
No affected product data is available for this CVE.
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 19, 2026 | New CVE Received | kernel.org |