CVE-2026-98308

CVE-2026-98308

published October 6, 2026

CVSS
—
EPSS
0%
Percentile
7.6
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

ALSA: hda: trace PCM open only after assigning a stream

Stream assignment can fail when hardware streams are exhausted.

Move the tracepoint after the NULL check because its payload accesses

the assigned stream tag.

Detected by static analysis and reviewed with AI-assisted source auditing.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00184 · 7.6th percentile
Published
2026-10-06T13:18Z
References (8)
https://git.kernel.org/stable/c/0a52ba6d3b268bb82f0ec4cb861bc68d252369c0 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/3c6ca6d9342f4a0be7c1413180e11023d13b5cde · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/3db8afba2d210b7d80cd5cc6b76d7f46daa9b47a · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/5a4c974dee03cc46eac43c82f33e34ec94f0b348 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/5c89e7965220e85d06ae4c58adb7d7bb6da2440c · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/8477643cb91c9e09ac1b11890eef421ae63e53f7 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/c9e6e5f38bf75276605f1952b22285f5f3abcaff · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/fba079ea22822248c82c3a999c88676d05b17bda · 416baaa9-dc9f-4396-8d5f-8c081fb06d67
EPSS history
Timeline
  • 07 OCT 03:43Z
    EPSS moved — → 0%
    epss
  • 06 OCT 08:46Z
    ALSA: hda: trace PCM open only after assigning a stream
    cvelistv5