What is the CVSS score of CVE-2026-98053?

CVE-2026-98053 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-98053?

Yes, a patch is available for CVE-2026-98053. Update the affected software to the latest version immediately.

Linux Kernel CVE-2026-98053

EUVD-2026-86706 MEDIUM

Out-of-bounds Read (CWE-125)

2026-09-25 Linux

GHSA-xpmc-f98f-h67j

Buffer Overflow Information Disclosure Linux Red Hat Intel Suse

5.5

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Gain local low-privileged access
Exploit

Supply malicious Intel AVS topology config
Execution

Trigger out-of-bounds read in init_configs array
Impact

Kernel crash / denial of service

Vulnerability Assessment

Weakness	CWE CWE-125 ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, read limits MITRE ATT&CK 1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Requires a system running the Linux kernel's Intel AVS (avs) ASoC audio driver and the ability to load or influence a DSP topology binary whose per-module config IDs reference entries beyond num_init_configs; the oversized ID is then used to index the init_configs array in avs_path_module_send_init_configs(). Exploitation is LIMITED to local access (AV:L) by a user who already holds at least low privilege (PR:L) sufficient to supply/trigger the topology load - it is not remotely reachable and not exploitable against systems lacking Intel AVS audio hardware/driver. Impact is confined to availability (kernel crash); no confidentiality or integrity effect is rated.
Impact	This is a medium-severity, low-priority issue in practice. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5) describes a purely local, availability-only flaw: an authenticated low-privileged actor (PR:L) with no user interaction can trigger an out-of-bounds read (CWE-125) that most plausibly crashes the kernel rather than leaking data. Supporting signals reinforce low urgency: EPSS is 0.17% (5th percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis. A clear conflict exists between the metadata tags ('Information Disclosure', 'Buffer Overflow') and the authoritative CVSS vector, which sets C:N (no confidentiality impact) - so despite the out-of-bounds READ classification, the rated impact is denial of service, not disclosure; treat the 'Information Disclosure' tag as unverified. Overall this is a genuine but defensive-maintenance-grade kernel fix, not an emergency: local-only reach, requires privilege to load/influence an Intel AVS topology, and no evidence of real-world exploitation.
Exploit ScenarioDerived	A local, low-privileged actor on a machine using the Intel AVS (Smart Sound Technology) audio driver supplies or influences a crafted DSP topology whose init-config IDs exceed num_init_configs. When avs_path_module_send_init_configs() indexes the init_configs array with that oversized ID, it reads out of bounds, most likely crashing the kernel (A:H). No public exploit code is identified at time of analysis.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 06, 2026

Out-of-bounds read in the Linux kernel's Intel AVS ASoC audio driver can crash the kernel when a local user with low privileges causes an oversized module config ID from a DSP topology binary to index the init_configs array. The flaw is limited to local, low-privilege access on systems with Intel AVS audio hardware and the relevant driver loaded; it is not remotely reachable and, per the assessed vector, has no confidentiality or integrity impact. EPSS is low (0.17%, 5th percentile), no public exploit code has been identified at time of analysis, and vendor fixes are available in Linux 6.18.53, 7.2.7, and 7.3-rc3 or corresponding stable backports.

RemediationAI

Vendor-released patches: Linux 6.18.53, 7.2.7, and 7.3-rc3 (or the corresponding stable backports) resolve the issue by refactoring the init_configs handling; apply the relevant kernel update from your distribution. If patching is delayed, mitigate by ensuring the Intel AVS ASoC driver (snd_soc_avs) is not loaded on systems that do not need Intel AVS audio, since the bug is only reachable through that driver and a locally supplied topology binary; this trades away AVS DSP audio functionality. Where AVS audio is required, restrict local users from loading or modifying untrusted DSP topology firmware and only permit signed or administrator-approved topologies, but note that this is a compensating control and not a substitute for the kernel patch. Upstream fix commits are at https://git.kernel.org/stable/c/681e91035dc794896a904852040837190e5041f5, https://git.kernel.org/stable/c/75bd5ea9c858d89fb8862f23afb00783bf02cd7a, and https://git.kernel.org/stable/c/8f20a0f4f7d638e83ae86db1719a24c7049762f5; the NVD entry is https://nvd.nist.gov/vuln/detail/CVE-2026-98053.

Affected VersionsENISA

Linux patch: 7.3-rc3

Linux 8a49ef789b1be68242624d460df2ada8087308a7 <681e91035dc794896a904852040837190e5041f5

Linux 6.9

Linux 8a49ef789b1be68242624d460df2ada8087308a7 <75bd5ea9c858d89fb8862f23afb00783bf02cd7a

Linux patch: 6.18.53

Linux patch: 7.2.7

Linux patch: 0

Linux 8a49ef789b1be68242624d460df2ada8087308a7 <8f20a0f4f7d638e83ae86db1719a24c7049762f5

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability is in the ALSA ASoC Intel AVS (Audio-Voice-Speech) driver in the Linux kernel. The driver loads DSP topology binaries containing an array of initialization configuration entries (init_configs[]) and a separate array of configuration IDs (config_ids[]). In avs_path_module_send_init_configs(), the code iterated over config_ids and used each ID to index init_configs, but checked only num_config_ids and not num_init_configs; an ID greater than or equal to num_init_configs therefore read past the end of the init_configs array. This is CWE-125 (out-of-bounds read). The upstream fix refactors the structure to keep a list of pointers to actual config entries instead of separate IDs and reuses the existing topology.c verification path, removing the index mismatch. The CPE cpe:2.3:a:linux:linux identifies the Linux kernel as affected. Exploitation requires local access (AV:L) and low privileges (PR:L) plus the ability to load or influence a DSP topology binary; it is not remotely reachable and only matters on systems with Intel AVS audio hardware and driver. Although tag data mentions Information Disclosure and Buffer Overflow, the assessed vector has C:N/I:N/A:H, so the confirmed impact here is availability loss through a kernel crash rather than confidentiality or integrity compromise.

Know when Intel gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI 5.5 MEDIUM

Local-only driver flaw needing a loaded topology and at least low privilege (AV:L, PR:L); out-of-bounds read crashes the kernel so A:H with C:N/I:N.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE 4.4 MEDIUM

AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Red Hat 5.5 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVSS changed

Oct 06, 2026 - 15:37 NVD

5.5 (MEDIUM)

Patch available

Sep 25, 2026 - 11:02 EUVD

CVE Published

Sep 25, 2026 - 10:24 cve.org

UNKNOWN (no severity yet)

CVE Published

Sep 25, 2026 - 10:24 nvd

MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

ASoC: Intel: avs: Refactor and fix init_config access

Existing code accesses enties found in ->init_configs array through indexes that are part of ->config_ids array. Those two are limited by: ->num_init_configs and ->num_config_ids respectively. Using ID larger or equal to ->num_init_configs leads to out-of-bounds access:

avs_path_module_send_init_configs() loop: (...) &acomp->tplg->init_configs[ids[i]] ^ out-of-bounds candidate

Rather than adding another if-statement, refactor the code. There is no need to store the IDs, have a list of pointers to actual config-entries instead. As the verification of ->init_config entries does not differ from verification of other types that are part of the topology.c file, simply reuse the code.

Threat Intelligence Overview

EPSS Score

0.2%

Top 95% exploitable

Prevalence

Ubiquitous

Linux kernel itself; vulnerable path limited to Intel AVS audio driver hardware

Data Quality

4 sources

Confidence: Medium

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS Vendor

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Defer

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact· derived

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +28

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Intel

View all

CVE-2021-44228 CRITICAL Act Now POC

10.0 Dec 10

Apache Log4j2 contains a critical JNDI injection vulnerability known as 'Log4Shell' that allows unauthenticated remote c

CVE-2017-5689 CRITICAL Act Now POC

9.8 May 02

An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Mana

CVE-2012-5958 CRITICAL Act Now POC

10.0 Jan 31