CVE-2026-74333

CVE-2026-74333 is a buffer overread in the acp-sdw-legacy sound driver, specifically in the create_sdw_dailinks() function. The function receives an array of soc_dais but is never told how many elements it contains. Instead, it relies on a sentinel-value assumption: the original code expected at least one entry to remain uninitialized, providing a natural loop termination condition. When the initialization path changed to mark all num_ends entries as initialized, the loop ran past the array bounds and triggered a KASAN warning. The fix—passing num_ends as an explicit parameter—is correct and straightforward. But the deeper lesson is that this vulnerability represents a structural API design failure, not a programmer error. Functions that operate on allocated arrays but receive no bounds information force developers to rely on implicit termination contracts that become invalid as code evolves downstream. The create_sdw_dailinks() function didn't change; the initialization logic two layers away did. The coupling between these code paths existed only as an undocumented assumption. What should you do? First, audit your drivers and subsystems for functions that operate on arrays without explicit bounds parameters, particularly in initialization and link-creation code paths. Second, treat any loop termination condition that depends on uninitialized or sentinel values as a red flag—this is the anti-pattern that enabled this bug. Third, recognize that KASAN caught this one, but many similar patterns exist in code paths without runtime sanitization. Production kernels across enterprise, cloud, and embedded deployments often run without KASAN, meaning this represents a class of vulnerability with unknown blast radius. The architectural question is whether kernel function signatures should mandate explicit bounds parameters for array operations as a coding standard—not because callers don't theoretically know the size, but because the caller and callee can evolve independently, breaking implicit contracts that were never formalized in the first place.

Reviewed through automated stages and approved by a human before publication.