CVE-2026-93187 is a vulnerability in Linux Kernel
Published on September 17, 2026
ASoC: SOF: ipc4-topology: Return error for invalid number of formats
In the Linux kernel, the following vulnerability has been resolved:
ASoC: SOF: ipc4-topology: Return error for invalid number of formats
When the number of input or output formats is zero,
sof_ipc4_widget_setup_comp_src() and sof_ipc4_widget_setup_comp_asrc()
print an error and jump to the cleanup label. At that point 'ret' is
still 0, because the earlier sof_ipc4_get_audio_fmt() call succeeded, so
the function returns success and the caller never finds out that the
widget setup actually failed.
Set ret to -EINVAL before the goto so the error gets reported.
Products Associated with CVE-2026-93187
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 21a5adffad463344e9aca6ee697f45a079cb3ef5 and below 4992cdc4eb97981d6ea66002c5b764a6115edb0c is affected.
- Version 21a5adffad463344e9aca6ee697f45a079cb3ef5 and below 11e828cd6b0f283ebe9dc6b4cffd38e3321e7725 is affected.
- Version 7.2 is affected.
- Before 7.2 is unaffected.
- Version 7.2.6, <= 7.2.* is unaffected.
- Version 7.3-rc1, <= * is unaffected.