CVE-2026-31778

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: fix stack out-of-bounds read in init_card The loop creates a whitespace-stripped copy of the card shortname where `len < sizeof(card->id)` is used for the bounds check. Since sizeof(card->id) is 16 and the local id buffer is also 16 bytes, writing 16 non-space characters fills the entire buffer, overwriting the terminating nullbyte. When this non-null-terminated string is later passed to snd_card_set_id() -> copy_valid_id_string(), the function scans forward with `while (*nid && ...)` and reads past the end of the stack buffer, reading the contents of the stack. A USB device with a product name containing many non-ASCII, non-space characters (e.g. multibyte UTF-8) will reliably trigger this as follows: BUG: KASAN: stack-out-of-bounds in copy_valid_id_string sound/core/init.c:696 [inline] BUG: KASAN: stack-out-of-bounds in snd_card_set_id_no_lock+0x698/0x74c sound/core/init.c:718 The off-by-one has been present since commit bafeee5b1f8d ("ALSA: snd_usb_caiaq: give better shortname") from June 2009 (v2.6.31-rc1), which first introduced this whitespace-stripping loop. The original code never accounted for the null terminator when bounding the copy. Fix this by changing the loop bound to `sizeof(card->id) - 1`, ensuring at least one byte remains as the null terminator.

Overview

State: PUBLISHED
Assigner (CNA): Linux
CVSS severity: high
CVSS score: 7.1 / 10
CVSS vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Effective score: 7.1 / 10 HIGH source: CNA overview
CWE(s): —
Reserved: 2026-03-09
Published: 2026-05-01 16:15 UTC
Last updated: 2026-05-12 00:15 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/31xxx/CVE-2026-31778.json
Linked Threat: CVE-2026-31778 — CVE-2026-31778

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-05-01 15:16:41 UTC
NVD last modified: 2026-05-11 18:05:22 UTC
NVD CVSS v3.1: 7.1 / 10 HIGH source: nvd@nist.gov
NVD CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Exploitability subscore: 1.8 / 10
Impact subscore: 5.2 / 10
EPSS score: 0.0001 (probability of exploitation in next 30 days)
EPSS percentile: 2.54% vs all CVEs — higher = more likely to be exploited, as of 2026-05-25

NVD-assigned CWE(s): CWE-125 (differs from the CNA list above)

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-26591
Assigner: Linux
Published: May 1, 2026, 2:15:05 PM
Updated: May 11, 2026, 10:15:37 PM
EUVD base score: 0.0 / 10
EUVD-reported EPSS: 0.0100
Vendors: Linux
Products: Linux (patch: 5.15.203)

Linux (patch: 6.12.81)

Linux (bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a <66194c2575a4f567577ae70b1d7561163ce791a6)

Linux (patch: 6.19.12)

Linux (patch: 7.0)

Linux (patch: 5.10.253)

Linux (patch: 6.1.168)

Linux (bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a <7594a6464873d90fd229e5b94cdd3b92c9feabed)

Linux (2.6.31)

Linux (bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a <3afa2e67f3523a980a2f90fd63c22322ac2b9ce0)

Linux (bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a <45424e871abf2a152e247a9cff78359f18dd95c0)

Linux (bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a <3178b62e2e31bab39f63d4c8e54bf4ee0a425627)

Linux (bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a <a82c1bce2d1299dd3c686a8fe48cf75b79a403c7)

Linux (patch: 6.18.22)

Linux (bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a <3f7f8bae0d52cbd07ab04b76b6aac89ef98ee9f6)

Linux (patch: 6.6.134)

Linux (bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a <02d9c5b0b5553a391448b6d655262bd829f90234)

Linux (patch: 0)

ENISA description: In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: fix stack out-of-bounds read in init_card The loop creates a whitespace-stripped copy of the card shortname where `len < sizeof(card->id)` is used for the bounds check. Since sizeof(card->id) is 16 and the local id buffer is also 16 bytes, writing 16 non-space characters fills the entire buffer, overwriting the terminating nullbyte. When this non-null-terminated string is later passed to snd_card_set_id() -> copy_valid_id_string(), the function scans forward with `while (*nid && ...)` and reads past the end of the stack buffer, reading the contents of the stack. A USB device with a product name containing many non-ASCII, non-space characters (e.g. multibyte UTF-8) will reliably trigger this as follows: BUG: KASAN: stack-out-of-bounds in copy_valid_id_string sound/core/init.c:696 [inline] BUG: KASAN: stack-out-of-bounds in snd_card_set_id_no_lock+0x698/0x74c sound/core/init.c:718 The off-by-one has been present since commit bafeee5b1f8d ("ALSA: snd_usb_caiaq: give better shortname") from June 2009 (v2.6.31-rc1), which first introduced this whitespace-stripping loop. The original code never accounted for the null terminator when bounding the copy. Fix this by changing the loop bound to `sizeof(card->id) - 1`, ensuring at least one byte remains as the null terminator.

EUVD references (8)

Affected products (2)

Vendor	Product	Versions	Platforms
Linux	Linux	`bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a` (affected), `bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a` (affected), `bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a` (affected), `bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a` (affected), `bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a` (affected), `bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a` (affected), `bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a` (affected), `bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a` (affected)	—
Linux	Linux	`2.6.31` (affected), `0` (unaffected), `5.10.253` (unaffected), `5.15.203` (unaffected), `6.1.168` (unaffected), `6.6.134` (unaffected), `6.12.81` (unaffected), `6.18.22` (unaffected), `6.19.12` (unaffected), `7.0` (unaffected)	—

Affected products — CPE 2.3 (7) NVD

NVD's normalized CPE 2.3 matchers, used by vendor tools (vulnerability scanners, asset managers) for automated detection. Compare with the CNA's free-text "Affected products" section above.

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*

Vendor references (8)

References embedded in the original CVE record by the assigning CNA.

Web references (14)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

http://cwe.mitre.org/data/definitions/125.html rapid7:cwe.mitre.org
https://attackerkb.com/topics/CVE-2026-31778 rapid7:attackerkb.com
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-26591 rapid7:euvd.enisa.europa.eu
https://git.kernel.org/stable/c/02d9c5b0b5553a391448b6d655262bd829f90234 tenable:git.kernel.org
https://git.kernel.org/stable/c/3178b62e2e31bab39f63d4c8e54bf4ee0a425627 tenable:git.kernel.org
https://git.kernel.org/stable/c/3afa2e67f3523a980a2f90fd63c22322ac2b9ce0 tenable:git.kernel.org
https://git.kernel.org/stable/c/3f7f8bae0d52cbd07ab04b76b6aac89ef98ee9f6 tenable:git.kernel.org
https://git.kernel.org/stable/c/45424e871abf2a152e247a9cff78359f18dd95c0 tenable:git.kernel.org
https://git.kernel.org/stable/c/66194c2575a4f567577ae70b1d7561163ce791a6 tenable:git.kernel.org
https://git.kernel.org/stable/c/7594a6464873d90fd229e5b94cdd3b92c9feabed tenable:git.kernel.org
https://git.kernel.org/stable/c/a82c1bce2d1299dd3c686a8fe48cf75b79a403c7 tenable:git.kernel.org
https://nvd.nist.gov/vuln/detail/CVE-2026-31778 tenable:nvd.nist.gov
https://www.cve.org/CVERecord?id=CVE-2026-31778 tenable:www.cve.org
https://www.first.org/epss/ tenable:www.first.org

NVD-tagged references (8)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://git.kernel.org/stable/c/02d9c5b0b5553a391448b6d655262bd829f90234 416baaa9-dc9f-4396-8d5f-8c081fb06d67 Patch
https://git.kernel.org/stable/c/3178b62e2e31bab39f63d4c8e54bf4ee0a425627 416baaa9-dc9f-4396-8d5f-8c081fb06d67 Patch
https://git.kernel.org/stable/c/3afa2e67f3523a980a2f90fd63c22322ac2b9ce0 416baaa9-dc9f-4396-8d5f-8c081fb06d67 Patch
https://git.kernel.org/stable/c/3f7f8bae0d52cbd07ab04b76b6aac89ef98ee9f6 416baaa9-dc9f-4396-8d5f-8c081fb06d67 Patch
https://git.kernel.org/stable/c/45424e871abf2a152e247a9cff78359f18dd95c0 416baaa9-dc9f-4396-8d5f-8c081fb06d67 Patch
https://git.kernel.org/stable/c/66194c2575a4f567577ae70b1d7561163ce791a6 416baaa9-dc9f-4396-8d5f-8c081fb06d67 Patch
https://git.kernel.org/stable/c/7594a6464873d90fd229e5b94cdd3b92c9feabed 416baaa9-dc9f-4396-8d5f-8c081fb06d67 Patch
https://git.kernel.org/stable/c/a82c1bce2d1299dd3c686a8fe48cf75b79a403c7 416baaa9-dc9f-4396-8d5f-8c081fb06d67 Patch

Remediations (17)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

Microsoft and Adobe Patch Tuesday, April 2026 Security Update Review

web:blog.qualys.com

With Qualys Policy Audit's out-of-the-box mitigation or Compensatory Controls, which reduce the risk of a vulnerability being exploited because the remediation ( fix / patch ) cannot be done immediately, these security controls are not recommended by any industry standards, such as CIS and DISA-STIG.

2026-05-23 20:02 UTC
Microsoft Releases Guidance on High-Severity Vulnerability (CVE-2025 ...

web:cisa.gov

Update (08/12/2025): CISA has updated this alert to provide clarification on identifying Exchange Servers on an organization's networks and provided further guidance on running the Microsoft Exchange Health Checker. Update (08/07/2025): CISA issued Emergency Directive (ED) 25-02: Mitigate Microsoft Exchange Vulnerability in response to CVE -2025-53786

2026-05-23 20:02 UTC
Microsoft Patch Tuesday August 2025: 107 Vulnerabilities ... - GBHackers

web:gbhackers.com

Microsoft has rolled out its August 2025 Patch Tuesday fixes, addressing a total of 107 vulnerabilities across its ecosystem.

2026-05-23 20:02 UTC
Patch Tuesday, May 2026 Edition - Krebs on Security

web:krebsonsecurity.com

Microsoft expects that exploitation is more likely. May's Patch Tuesday is a welcome respite from April, which saw Microsoft fix a near-record 167 security flaws.

2026-05-23 20:02 UTC
Security Update Guide - Microsoft

web:portal.msrc.microsoft.com

The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

2026-05-23 20:02 UTC
August 2025 Patch Tuesday: Updates and Analysis | CrowdStrike

web:www.crowdstrike.com

Microsoft has released security updates for 107 vulnerabilities, including one publicly disclosed zero-day and 13 critical, in its August 2025 Patch Tuesday rollout.

2026-05-23 20:02 UTC
CVE Record: CVE-2026-32778

web:www.cve.org

Vulnerability detail for CVE - 2026 -32778 Notice: Expanded keyword searching of CVE Records (with limitations) is now available in the search box above. Learn more here.

2026-05-23 20:02 UTC
Oracle Critical Patch Update Advisory - April 2026

web:www.oracle.com

This Critical Patch Update contains 481 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at April 2026 Critical Patch Update: Executive Summary and Analysis.

2026-05-23 20:02 UTC
Microsoft Patches Over 100 Vulnerabilities - SecurityWeek

web:www.securityweek.com

Microsoft's August 2025 Patch Tuesday updates address critical vulnerabilities in Windows, Office, and Hyper-V.

2026-05-23 20:02 UTC
Patch Tuesday May 2026: Security Updates & CVE Analysis

web:zecurit.com

Get the complete breakdown of Microsoft's May 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .

2026-05-23 20:02 UTC
Microsoft and Adobe Patch Tuesday, May 2026 Security Update Review

web:blog.qualys.com

May 2026's Patch Tuesday arrives with Microsoft addressing a fresh set of vulnerabilities across its ecosystem, reinforcing the ongoing need for timely patching in an increasingly threat-heavy…

2026-06-03 07:49 UTC
Microsoft Patch Tuesday May 2026 - 120 Vulnerabilities Fixed, Including ...

web:cybersecuritynews.com

Microsoft's May 2026 Patch Tuesday lands with a heavy enterprise focus, fixing 120 vulnerabilities across Windows, Office, Azure, developer tools, and Microsoft 365 apps, including 29 remote code execution (RCE) flaws rated Critical.

2026-06-03 07:49 UTC
NVD - Home

web:nvd.nist.gov

The NVD is the U.S. government repository of standards based vulnerability management data represented using the Security Content Automation Protocol (SCAP). This data enables automation of vulnerability management, security measurement, and compliance. The NVD includes databases of security checklist references, security-related software flaws, product names, and impact metrics. For ...

2026-06-03 07:49 UTC
April 2026 Patch Tuesday: Updates and Analysis | CrowdStrike

web:www.crowdstrike.com

Microsoft's April 2026 Patch Tuesday addresses 164 CVEs , featuring 8 Critical vulnerabilities, one exploited zero-day, and one disclosed zero-day.

2026-06-03 07:49 UTC
May 2026 Microsoft Patch Tuesday: Critical Security Updates, Secure ...

web:www.dbtsupport.com

The May 2026 Microsoft Patch Tuesday release includes security updates across supported Microsoft products and should be reviewed directly in the Microsoft Security Update Guide for the final CVE list, affected products, severity ratings, exploitability assessments, and any revised guidance.

2026-06-03 07:49 UTC
Update Chrome now: Critical bugs could let attackers run code

web:www.malwarebytes.com

This Chrome update fixes critical flaws attackers could exploit through malicious websites, but not the "Browser Fetch" vulnerability.

2026-06-03 07:49 UTC
Quantifying 2026 Routinely Targeted Vulnerabilities (So Far)

web:www.vulncheck.com

VulnCheck identified 25 CVEs disclosed in 2026 that have been routinely targeted by adversaries and researchers so far this year, drawing from a global body of exploit code and exploitation data.

2026-06-03 07:49 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-31778.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/usb/caiaq/device.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "02d9c5b0b5553a391448b6d655262bd829f90234",
              "status": "affected",
              "version": "bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a",
              "versionType": "git"
            },
            {
              "lessThan": "3f7f8bae0d52cbd07ab04b76b6aac89ef98ee9f6",
              "status": "affected",
              "version": "bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a",
              "versionType": "git"
            },
            {
              "lessThan": "66194c2575a4f567577ae70b1d7561163ce791a6",
              "status": "affected",
              "version": "bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a",
              "versionType": "git"
            },
            {
              "lessThan": "a82c1bce2d1299dd3c686a8fe48cf75b79a403c7",
              "status": "affected",
              "version": "bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a",
              "versionType": "git"
            },
            {
              "lessThan": "3178b62e2e31bab39f63d4c8e54bf4ee0a425627",
              "status": "affected",
              "version": "bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a",
              "versionType": "git"
            },
            {
              "lessThan": "3afa2e67f3523a980a2f90fd63c22322ac2b9ce0",
              "status": "affected",
              "version": "bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a",
              "versionType": "git"
            },
            {
              "lessThan": "7594a6464873d90fd229e5b94cdd3b92c9feabed",
              "status": "affected",
              "version": "bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a",
              "versionType": "git"
            },
            {
              "lessThan": "45424e871abf2a152e247a9cff78359f18dd95c0",
              "status": "affected",
              "version": "bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/usb/caiaq/device.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.31"
            },
            {
              "lessThan": "2.6.31",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.134",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.81",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.22",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.253",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.168",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.134",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.81",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.22",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.12",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: caiaq: fix stack out-of-bounds read in init_card\n\nThe loop creates a whitespace-stripped copy of the card shortname\nwhere `len < sizeof(card->id)` is used for the bounds check. Since\nsizeof(card->id) is 16 and the local id buffer is also 16 bytes,\nwriting 16 non-space characters fills the entire buffer,\noverwriting the terminating nullbyte.\n\nWhen this non-null-terminated string is later passed to\nsnd_card_set_id() -> copy_valid_id_string(), the function scans\nforward with `while (*nid && ...)` and reads past the end of the\nstack buffer, reading the contents of the stack.\n\nA USB device with a product name containing many non-ASCII, non-space\ncharacters (e.g. multibyte UTF-8) will reliably trigger this as follows:\n\n  BUG: KASAN: stack-out-of-bounds in copy_valid_id_string\n       sound/core/init.c:696 [inline]\n  BUG: KASAN: stack-out-of-bounds in snd_card_set_id_no_lock+0x698/0x74c\n       sound/core/init.c:718\n\nThe off-by-one has been present since commit bafeee5b1f8d (\"ALSA:\nsnd_usb_caiaq: give better shortname\") from June 2009 (v2.6.31-rc1),\nwhich first introduced this whitespace-stripping loop. The original\ncode never accounted for the null terminator when bounding the copy.\n\nFix this by changing the loop bound to `sizeof(card->id) - 1`,\nensuring at least one byte remains as the null terminator."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:15:37.687Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/02d9c5b0b5553a391448b6d655262bd829f90234"
        },
        {
          "url": "https://git.kernel.org/stable/c/3f7f8bae0d52cbd07ab04b76b6aac89ef98ee9f6"
        },
        {
          "url": "https://git.kernel.org/stable/c/66194c2575a4f567577ae70b1d7561163ce791a6"
        },
        {
          "url": "https://git.kernel.org/stable/c/a82c1bce2d1299dd3c686a8fe48cf75b79a403c7"
        },
        {
          "url": "https://git.kernel.org/stable/c/3178b62e2e31bab39f63d4c8e54bf4ee0a425627"
        },
        {
          "url": "https://git.kernel.org/stable/c/3afa2e67f3523a980a2f90fd63c22322ac2b9ce0"
        },
        {
          "url": "https://git.kernel.org/stable/c/7594a6464873d90fd229e5b94cdd3b92c9feabed"
        },
        {
          "url": "https://git.kernel.org/stable/c/45424e871abf2a152e247a9cff78359f18dd95c0"
        }
      ],
      "title": "ALSA: caiaq: fix stack out-of-bounds read in init_card",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31778",
    "datePublished": "2026-05-01T14:15:05.804Z",
    "dateReserved": "2026-03-09T15:48:24.140Z",
    "dateUpdated": "2026-05-11T22:15:37.687Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}