Cloudanix VulnDB

CVE-2026-98743

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A coding mistake in a Linux audio driver could let the system use random uninitialized data, which might cause audio features to misbehave or crash.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Other
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Uninitialized stream_config structure passed to sdw_stream_add_slave() allows garbage data in the type field to be copied into stream->type by sdw_config_stream(), resulting in undefined behavior in SoundWire stream handling.

Why it matters to the business

Audio subsystem instability or crashes on Linux systems using the affected codec driver, potentially affecting voice, media, or conferencing workloads with low likelihood of remote exploitation.

How an attack unfolds

An attacker with local access triggers the codec driver code path that allocates an uninitialized stream_config and passes it to sdw_stream_add_slave(); the resulting garbage type value propagates through sdw_config_stream() and can produce memory corruption or invalid stream state.

How to fix it

Apply the upstream kernel commit that zero-initializes stream_config and switches to snd_sdw_params_to_config(); rebuild and deploy the fixed kernel image.

How to confirm the fix worked

Confirm the presence of the zero-initialization of stream_config before sdw_stream_add_slave() and the call to snd_sdw_params_to_config() in the rt1017-sdca-sdw driver source.

Typical attack path

  1. Obtain local code execution on a Linux system with the rt1017-sdca-sdw driver loaded
  2. Trigger SoundWire stream allocation for the rt1017 codec
  3. Allow uninitialized type field to be used during sdw_config_stream()
  4. Observe resulting kernel memory corruption or driver malfunction

How to detect it

Review kernel logs for SoundWire or ASoC errors around stream configuration; inspect crash dumps for references to sdw_stream_add_slave or rt1017-sdca-sdw with uninitialized type values.

What your security team should do

  • Prioritize kernel update for any systems exposing audio hardware using rt1017-sdca-sdw
  • Monitor EPSS and exploit maturity indicators for any increase in the next 30 days
  • Apply the fix within standard patch windows given low EPSS and absence from KEV

The record

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config->type stream_config is not initialized before being passed to sdw_stream_add_slave(). The type field may contain garbage and is later copied to stream->type by sdw_config_stream(). Zero-initialize stream_config so type defaults to SDW_STREAM_PCM. While at it, use snd_sdw_params_to_config() helper instead of open-coding the same logic.

Affected packages

Ecosystem Package Introduced Fixed