{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98744", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.367Z", "datePublished": "2026-10-18T15:47:29.706Z", "dateUpdated": "2026-10-21T12:56:20.042Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:56:20.042Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: codecs: max98363: fix uninitialized stream_config->type\n\nstream_config is not initialized before being passed to\nsdw_stream_add_slave(). The type field may contain garbage and is\nlater copied to stream->type by sdw_config_stream().\n\nZero-initialize stream_config so type defaults to SDW_STREAM_PCM."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/soc/codecs/max98363.c"], "versions": [{"version": "18c0af945fa35766730d3f729adcf417a3d1ad5d", "lessThan": "a756c93fae312cc2bcdf157a0992e505573c530f", "status": "affected", "versionType": "git"}, {"version": "18c0af945fa35766730d3f729adcf417a3d1ad5d", "lessThan": "1c251426bb67de5cbfd3b5550bd5983736e8b9c7", "status": "affected", "versionType": "git"}, {"version": "18c0af945fa35766730d3f729adcf417a3d1ad5d", "lessThan": "7df8c39a50f364c04d68881e61ba1ecad29d4b72", "status": "affected", "versionType": "git"}, {"version": "18c0af945fa35766730d3f729adcf417a3d1ad5d", "lessThan": "f44ba04c7a32bd13dbdcd814385b8629d0ee95e3", "status": "affected", "versionType": "git"}, {"version": "18c0af945fa35766730d3f729adcf417a3d1ad5d", "lessThan": "bcd61aa247c28b721ac21dda6e4135f75a2de29f", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/soc/codecs/max98363.c"], "versions": [{"version": "6.4", "status": "affected"}, {"version": "0", "lessThan": "6.4", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.56", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.18.56"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "7.2.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a756c93fae312cc2bcdf157a0992e505573c530f"}, {"url": "https://git.kernel.org/stable/c/1c251426bb67de5cbfd3b5550bd5983736e8b9c7"}, {"url": "https://git.kernel.org/stable/c/7df8c39a50f364c04d68881e61ba1ecad29d4b72"}, {"url": "https://git.kernel.org/stable/c/f44ba04c7a32bd13dbdcd814385b8629d0ee95e3"}, {"url": "https://git.kernel.org/stable/c/bcd61aa247c28b721ac21dda6e4135f75a2de29f"}], "title": "ASoC: codecs: max98363: fix uninitialized stream_config->type", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["sound/soc/codecs/max98363.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "a756c93fae312cc2bcdf157a0992e505573c530f", "status": "affected", "version": "18c0af945fa35766730d3f729adcf417a3d1ad5d", "versionType": "git"}, {"lessThan": "1c251426bb67de5cbfd3b5550bd5983736e8b9c7", "status": "affected", "version": "18c0af945fa35766730d3f729adcf417a3d1ad5d", "versionType": "git"}, {"lessThan": "7df8c39a50f364c04d68881e61ba1ecad29d4b72", "status": "affected", "version": "18c0af945fa35766730d3f729adcf417a3d1ad5d", "versionType": "git"}, {"lessThan": "f44ba04c7a32bd13dbdcd814385b8629d0ee95e3", "status": "affected", "version": "18c0af945fa35766730d3f729adcf417a3d1ad5d", "versionType": "git"}, {"lessThan": "bcd61aa247c28b721ac21dda6e4135f75a2de29f", "status": "affected", "version": "18c0af945fa35766730d3f729adcf417a3d1ad5d", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["sound/soc/codecs/max98363.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.4"}, {"lessThan": "6.4", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.56", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: codecs: max98363: fix uninitialized stream_config->type\n\nstream_config is not initialized before being passed to\nsdw_stream_add_slave(). The type field may contain garbage and is\nlater copied to stream->type by sdw_config_stream().\n\nZero-initialize stream_config so type defaults to SDW_STREAM_PCM."}], "id": "CVE-2026-98744", "lastModified": "2026-10-21T13:21:42.073", "metrics": {}, "published": "2026-10-18T16:17:28.140", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1c251426bb67de5cbfd3b5550bd5983736e8b9c7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7df8c39a50f364c04d68881e61ba1ecad29d4b72"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a756c93fae312cc2bcdf157a0992e505573c530f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bcd61aa247c28b721ac21dda6e4135f75a2de29f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f44ba04c7a32bd13dbdcd814385b8629d0ee95e3"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: ASoC: codecs: max98363: fix uninitialized stream_config->type", "id": "2555115", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555115"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-908", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nASoC: codecs: max98363: fix uninitialized stream_config->type\nstream_config is not initialized before being passed to\nsdw_stream_add_slave(). The type field may contain garbage and is\nlater copied to stream->type by sdw_config_stream().\nZero-initialize stream_config so type defaults to SDW_STREAM_PCM.", "A flaw was found in the Linux kernel's MAX98363 audio codec driver. A local user could trigger this vulnerability during audio stream configuration because internal stream parameters are left uninitialized in memory. This issue allows uninitialized values to be processed by the sound subsystem, potentially causing system instability or a Denial of Service (DoS)."], "name": "CVE-2026-98744", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98744\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98744\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98744.mbox"], "threat_severity": "Moderate"}