← Back to CVE Explorer

CVE-2026-46088

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() snd_ctl_elem_init_enum_names() advances pointer p through the names buffer while decrementing buf_len. If buf_len reaches zero but items remain, the next iteration calls strnlen(p, 0). While strnlen(p, 0) returns 0 and would hit the existing name_len == 0 error path, CONFIG_FORTIFY_SOURCE's fortified strnlen() first checks maxlen against __builtin_dynamic_object_size(). When Clang loses track of p's object size inside the loop, this triggers a BRK exception panic before the return value is examined. Add a buf_len == 0 guard at the loop entry to prevent calling fortified strnlen() on an exhausted buffer. Found by kernel fuzz testing through Xiaomi Smartphone.

Severity
MEDIUM
CVSS score
5.5 (v3.1)
Vulnerability status
Modified
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-05-27 14:17:30.333000
Last modified
2026-11-06 17:17:36.597000
View original CVE JSON 
{
  "id": "CVE-2026-46088",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2026-05-27T14:17:30.333",
  "lastModified": "2026-11-06T17:17:36.597",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names()\n\nsnd_ctl_elem_init_enum_names() advances pointer p through the names\nbuffer while decrementing buf_len. If buf_len reaches zero but items\nremain, the next iteration calls strnlen(p, 0).\n\nWhile strnlen(p, 0) returns 0 and would hit the existing name_len == 0\nerror path, CONFIG_FORTIFY_SOURCE's fortified strnlen() first checks\nmaxlen against __builtin_dynamic_object_size(). When Clang loses track\nof p's object size inside the loop, this triggers a BRK exception panic\nbefore the return value is examined.\n\nAdd a buf_len == 0 guard at the loop entry to prevent calling fortified\nstrnlen() on an exhausted buffer.\n\nFound by kernel fuzz testing through Xiaomi Smartphone."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "sound/core/control.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "8d448162bda5ae3b5ecb26fe50c8fbbeae99faa4",
              "lessThan": "708f6ec9bcdf58bfd561409110baaf4fd3be4ea3",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "8d448162bda5ae3b5ecb26fe50c8fbbeae99faa4",
              "lessThan": "bfcbb4994da9e979c4bcfcf24aaaac69e457e48e",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "8d448162bda5ae3b5ecb26fe50c8fbbeae99faa4",
              "lessThan": "a470f7cabc4df72d9bd132f5719a8717292bb440",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "8d448162bda5ae3b5ecb26fe50c8fbbeae99faa4",
              "lessThan": "1fbe46d2b72754d8bd580e13e59ccb5d3d0e8cb0",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "8d448162bda5ae3b5ecb26fe50c8fbbeae99faa4",
              "lessThan": "8ba0214c3dd32b8ec652947e3f2bc5b8f6e6be9e",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "8d448162bda5ae3b5ecb26fe50c8fbbeae99faa4",
              "lessThan": "654c818a69c21d2bea4e8fd9eae7da865df9a5c8",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "8d448162bda5ae3b5ecb26fe50c8fbbeae99faa4",
              "lessThan": "82012fd3e78a14360fbc2f1a7491589896704f97",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "8d448162bda5ae3b5ecb26fe50c8fbbeae99faa4",
              "lessThan": "e0da8a8cac74f4b9f577979d131f0d2b88a84487",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "sound/core/control.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "3.2",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "3.2",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.10.258",
              "lessThanOrEqual": "5.10.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.15.209",
              "lessThanOrEqual": "5.15.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.1.175",
              "lessThanOrEqual": "6.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.6.140",
              "lessThanOrEqual": "6.6.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.86",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18.27",
              "lessThanOrEqual": "6.18.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.0.4",
              "lessThanOrEqual": "7.0.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.1",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    },
    {
      "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
      "affectedData": [
        {
          "vendor": "Siemens",
          "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
          "defaultStatus": "unknown",
          "versions": [
            {
              "version": "0",
              "lessThan": "*",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-11-06T16:08:00.542571Z",
          "id": "CVE-2026-46088",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "3.2",
              "versionEndExcluding": "5.10.258",
              "matchCriteriaId": "6297D9F9-EB7C-456A-A816-A1326116C005"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "5.11",
              "versionEndExcluding": "5.15.209",
              "matchCriteriaId": "919C10A9-7951-4A74-BADD-C135A0A8D8B4"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "5.16",
              "versionEndExcluding": "6.1.175",
              "matchCriteriaId": "92385813-D91D-480D-83A1-F423D2CBB2BA"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.2",
              "versionEndExcluding": "6.6.140",
              "matchCriteriaId": "A1A92866-F406-43B5-B2D1-CFC274753E9D"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.7",
              "versionEndExcluding": "6.12.86",
              "matchCriteriaId": "55DA1C62-9991-451E-B8A8-E0004E00F789"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.13",
              "versionEndExcluding": "6.18.27",
              "matchCriteriaId": "A10AC84F-C058-47D5-85B4-E6E51A613B74"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.19",
              "versionEndExcluding": "7.0.4",
              "matchCriteriaId": "CDB78D6D-22C3-4154-B0D0-94AF1CE5C2E3"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/1fbe46d2b72754d8bd580e13e59ccb5d3d0e8cb0",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/654c818a69c21d2bea4e8fd9eae7da865df9a5c8",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/708f6ec9bcdf58bfd561409110baaf4fd3be4ea3",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/82012fd3e78a14360fbc2f1a7491589896704f97",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/8ba0214c3dd32b8ec652947e3f2bc5b8f6e6be9e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/a470f7cabc4df72d9bd132f5719a8717292bb440",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/bfcbb4994da9e979c4bcfcf24aaaac69e457e48e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/e0da8a8cac74f4b9f577979d131f0d2b88a84487",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html",
      "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"
    }
  ]
}