CVE-2026-89943

8.4 HIGH

Published 2026-09-16 · Updated 2026-09-16

AI risk analysis

Summary: The flaw involves an uninitialized pointer due to unhandled error conditions in the `codec-dai-name` property parsing within the ASoC driver for the loongson platform, which could lead to undefined behavior.
Exploitability: Exploitation requires the `codec-dai-name` property to be missing or invalid, making it moderately difficult. Precondition is the presence of the loongson platform and the ASoC driver in use.
Blast radius: If exploited, the impact could be severe, potentially leading to system instability or crashes, given the undefined behavior that could result from using an uninitialized pointer.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to the fixed version 5.19.60 or later.

undefined-behaviordriver-vulnerabilityloongson

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

In the Linux kernel, the following vulnerability has been resolved: ASoC: loongson: Fix error handling in ACPI property parsing In loongson_card_parse_acpi(), the return value of device_property_read_string() for the `codec-dai-name` property was ignored. If the property is missing or invalid, an uninitialized pointer would be used later, potentially leading to undefined behavior. Fix this by checking the return value and propagating the error appropriately.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Data: NVD (public domain). Analysis: local $0 model. Defensive use only.