Linux Kernel CVE-2026-46088

The affected code lives in the ALSA (Advanced Linux Sound Architecture) control layer (sound/core/control.c). snd_ctl_elem_init_enum_names() iterates a packed buffer of null-terminated strings to populate enum control element names, advancing pointer p and decrementing buf_len each iteration. The root cause is a missing exit guard: when buf_len reaches zero before all items are consumed, the code passes buf_len=0 to strnlen(). Under CONFIG_FORTIFY_SOURCE, Clang's fortified strnlen performs a __builtin_dynamic_object_size check on p before evaluating the return value; because Clang loses track of p's object size through the loop, this check fires a BRK instruction, raising a kernel panic. GCC-compiled kernels or kernels without CONFIG_FORTIFY_SOURCE handle strnlen(p, 0) gracefully (return 0, hit existing name_len==0 error path). No CWE is formally assigned; the closest applicable class is an off-by-one or missing bounds-check (CWE-193/CWE-119). CPE: cpe:2.3:o:linux:linux_kernel.