Linux Kernel EUVD-2026-86706

Requires a system running the Linux kernel's Intel AVS (avs) ASoC audio driver and the ability to load or influence a DSP topology binary whose per-module config IDs reference entries beyond num_init_configs; the oversized ID is then used to index the init_configs array in avs_path_module_send_init_configs(). Exploitation is LIMITED to local access (AV:L) by a user who already holds at least low privilege (PR:L) sufficient to supply/trigger the topology load - it is not remotely reachable and not exploitable against systems lacking Intel AVS audio hardware/driver. Impact is confined to availability (kernel crash); no confidentiality or integrity effect is rated.

This is a medium-severity, low-priority issue in practice. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5) describes a purely local, availability-only flaw: an authenticated low-privileged actor (PR:L) with no user interaction can trigger an out-of-bounds read (CWE-125) that most plausibly crashes the kernel rather than leaking data. Supporting signals reinforce low urgency: EPSS is 0.17% (5th percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis. A clear conflict exists between the metadata tags ('Information Disclosure', 'Buffer Overflow') and the authoritative CVSS vector, which sets C:N (no confidentiality impact) - so despite the out-of-bounds READ classification, the rated impact is denial of service, not disclosure; treat the 'Information Disclosure' tag as unverified. Overall this is a genuine but defensive-maintenance-grade kernel fix, not an emergency: local-only reach, requires privilege to load/influence an Intel AVS topology, and no evidence of real-world exploitation.

A local, low-privileged actor on a machine using the Intel AVS (Smart Sound Technology) audio driver supplies or influences a crafted DSP topology whose init-config IDs exceed num_init_configs. When avs_path_module_send_init_configs() indexes the init_configs array with that oversized ID, it reads out of bounds, most likely crashing the kernel (A:H). No public exploit code is identified at time of analysis.