CVE-2026-98744

What it actually does

Uninitialized stream_config->type field containing garbage data is passed to sdw_stream_add_slave() and later copied into stream->type by sdw_config_stream(), resulting in undefined behavior in the SoundWire audio stream setup path.

Why it matters to the business

Audio playback or recording on affected systems can trigger kernel instability or crashes, disrupting multimedia and voice functions until the kernel is updated.

How an attack unfolds

An attacker with local access triggers audio stream initialization through the max98363 codec driver; the uninitialized type value leads to invalid stream configuration that may be abused for memory corruption or denial of service.

How to fix it

Update the Linux kernel to the version containing the zero-initialization fix for stream_config in the max98363 driver.

How to confirm the fix worked

Inspect the max98363 driver source to confirm stream_config is zero-initialized before the sdw_stream_add_slave call; test audio stream creation after applying the update.

Typical attack path

1. Obtain local code execution or user access on target
2. Invoke ALSA or SoundWire stream setup that exercises max98363
3. sdw_stream_add_slave receives uninitialized config
4. sdw_config_stream copies garbage type value causing corruption

How to detect it

Review kernel logs for max98363 or sdw_stream related errors or warnings around audio initialization; no public exploitation artifacts are known.

What your security team should do

• Prioritize kernel update on systems using max98363 or similar SoundWire codecs
• Reboot affected hosts after patching
• Monitor kernel logs for audio stream initialization failures