CVE-2026-90196

CVE-2026-90196

published September 17, 2026

CVSS
—
EPSS
0%
Percentile
10.0
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

ASoC: SOF: validate topology volume range before allocation

SOF treats the topology mixer min and max values as non-negative indices

into its volume table. It stores them in signed fields, allocates max + 1

entries through an int argument, and later indexes the table with the

stored range.

An inverted range is invalid, while a maximum at or above INT_MAX cannot

be represented safely after the increment or in the signed fields.

Validate the complete range before storing it or allocating the table.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00205 · 10.0th percentile
Published
2026-09-17T21:17Z
References (6)
EPSS history
Timeline
  • 19 SEP 03:55Z
    EPSS moved — → 0%
    epss
  • 17 SEP 16:07Z
    ASoC: SOF: validate topology volume range before allocation
    cvelistv5