CVSS 3.1
5.5 mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HCVE-2026-31619
Medium (5.5) in linux linux kernel. EPSS 0.1% chance of exploitation in the next 30 days.
In the Linux kernel, the following vulnerability has been resolved:
ALSA: fireworks: bound device-supplied status before string array lookup
The status field in an EFW response is a 32-bit value supplied by the
firewire device. efr_status_names[] has 17 entries so a status value
outside that range goes off into the weeds when looking at the %s value.
Even worse, the status could return EFR_STATUS_INCOMPLETE which is
0x80000000, and is obviously not in that array of potential strings.
Fix this up by properly bounding the index against the array size and
printing "unknown" if it's not recognized.
Severity
- EPSS
- 0.1% chance of exploitation in the next 30 days; higher than 2% of CVEs (scores of 2026-10-31)
- Published
- Modified
- Record from
- the NVD, synced
Affected
- linux:linux_kernel
References
- https://git.kernel.org/stable/c/07704bbf36f57e4379e4cadf96410dab14621e3b
- https://git.kernel.org/stable/c/183aa0de0f680496b9feb85c9d182681ad4600dd
- https://git.kernel.org/stable/c/327f8e730e3c65ec97df9d3b07de66aeb3dc932d
- https://git.kernel.org/stable/c/62fcb273fbee5b2a0e7ed41cc914c8d7d1a5d285
- https://git.kernel.org/stable/c/67cfd14074cdafab5de3f7cfc0952c1a9b653e5d