CVE-2026-74333 Linux CVE debrief

Who should care

Defenders responsible for Linux kernel systems, particularly those using ASoC: amd: acp-sdw-legacy, should assess exposure and prioritize patching affected versions. This includes system administrators, security teams, and developers working with Linux kernel versions listed as affected.

Why it matters

Defenders should prioritize verifying and applying patches for Linux kernel versions affected by this vulnerability to prevent potential slab-out-of-bounds reads. This requires assessing exposure of Linux kernel systems using ASoC: amd: acp-sdw-legacy and prioritizing patching of affected versions.

• Verify Linux kernel versions and apply patches to prevent potential slab-out-of-bounds reads.
• Assess exposure of Linux kernel systems using ASoC: amd: acp-sdw-legacy and prioritize patching.
• Monitor Linux kernel version updates and apply patches as they become available to maintain system security.

Technical summary

The create_sdw_dailinks function in ASoC: amd: acp-sdw-legacy was not properly bounding its iteration over the soc_dais array. This could lead to slab-out-of-bounds reads if all entries in the array were initialised. The function has been modified to accept the allocated entry count and stop before reading past the array. This change ensures that the iteration does not exceed the allocated array size, preventing slab-out-of-bounds reads. The update requires verifying and applying patches for affected Linux kernel versions to maintain system security.

Defensive priority

Defenders should prioritize verifying and applying patches for Linux kernel versions affected by this vulnerability, particularly those versions listed as affected in the source item.

Recommended defensive actions

• Verify Linux kernel versions in use and compare them to the affected versions listed in the source item.
• Apply patches or updates provided by the Linux kernel maintainers for the affected versions.
• Monitor Linux kernel version updates and apply patches as they become available.
• Review system configurations and ensure that compensating controls are in place to mitigate potential impacts.
• Conduct a thorough review of system logs to identify potential exploitation attempts.
• Update asset inventory to reflect systems that may be affected by this vulnerability.
• Schedule regular security audits to ensure timely detection and remediation of similar vulnerabilities.

Evidence notes

Evidence is based on official CVE Program record, NVD vulnerability detail, and source item from cve_program_cvelist_v5. The CVE record and NVD entry provide details on the vulnerability, while the source item offers additional context from the Linux kernel community.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.