Reference page — cumulative record through Thursday, October 8, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV L L L N U N N H 5.5 .0012 1.7 —
AFFECTED Product Versions Fixed Linux 8a49ef789b1be68242624d460df2ada8087308a7 – — Linux 6.9 – 6.18.53
TIMELINE Sep 25 Reserved by Linux Sep 25 Published (CNA: Linux) Oct 6 ENRICHED — CVE-2026-98053 (Linux). Received CVSS 5.5 and CPE data from NVD.
In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Refactor and fix init_config access Existing code accesses enties found in ->init_configs array through indexes that are part of ->config_ids array. Those two are limited by: ->num_init_configs and ->num_config_ids respectively. Using ID larger or equal to ->num_init_configs leads to out-of-bounds access: avs_path_module_send_init_configs() loop: (...) &acomp->tplg->init_configs[ids[i]] ^ out-of-bounds candidate Rather than adding another if-statement, refactor the code. There is no need to store the IDs, have a list of pointers to actual config-entries instead. As the verification of ->init_config entries does not differ from verification of other types that are part of the topology.c file, simply reuse the code.
| Date | Event | Detail |
|---|---|---|
| September 25, 2026 | Reserved | Reserved by Linux |
| September 25, 2026 | Published | Published (CNA: Linux) |
| October 6, 2026 | ENRICHED | ENRICHED — CVE-2026-98053 (Linux). Received CVSS 5.5 and CPE data from NVD. |
Authoritative record: CVE-2026-98053 at cve.org
Vendors: linux
Weaknesses: CWE-125
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-98053 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Thursday, October 8, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
