Not yet scoredPublished Dec 8, 2025

CVE-2023-53788ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set()

Updated under an hour ago (Oct 27, 2026, 2:30 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set() tuning_ctl_set() might have buffer overrun at (X) if it didn't break from loop by matching (A). static int tuning_ctl_set(...) { for (i = 0; i < TUNING_CTLS_COUNT; i++) (A) if (nid == ca0132_tuning_ctls[i].nid) break; snd_hda_power_up(...); (X) dspio_set_param(..., ca0132_tuning_ctls[i].mid, ...); snd_hda_power_down(...); ^ return 1; } We will get below error by cppcheck sound/pci/hda/patch_ca0132.c:4229:2: note: After for loop, i has value 12 for (i = 0; i < TUNING_CTLS_COUNT; i++) ^ sound/pci/hda/patch_ca0132.c:4234:43: note: Array index out of bounds dspio_set_param(codec, ca0132_tuning_ctls[i].mid, 0x20, ^ This patch cares non match case.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Deferred
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 44f0c9782cc6ab71ea947f8f710a46f2078a151c before ff5e8b49348f6a550c136b74efaf8b3c1d3ceaea; from 44f0c9782cc6ab71ea947f8f710a46f2078a151c before 3590498117a11aa1f92a97e8a04d95320e347ebd; 44f0c9782cc6ab71ea947f8f710a46f2078a151c builds before 7f12f99b8017ad5ed5aff4b0aefe3bb7bbdf8a99; from 44f0c9782cc6ab71ea947f8f710a46f2078a151c before baef27176ea5fdc7ad0947e2dc7733855e35db71; from 44f0c9782cc6ab71ea947f8f710a46f2078a151c before d23f65f08247068576a01e28b297e995b7dc3965; from 44f0c9782cc6ab71ea947f8f710a46f2078a151c before 32854bc91ae7debcdefdc7ae881ed83385a04792; from 44f0c9782cc6ab71ea947f8f710a46f2078a151c before 734a3deb6614e3597e7e9ef7fb6006c593c5ee18; from 44f0c9782cc6ab71ea947f8f710a46f2078a151c before 98e5eb110095ec77cb6d775051d181edbf9cd3cf	CNA record

References

References

https://git.kernel.org/stable/c/ff5e8b49348f6a550c136b74efaf8b3c1d3ceaea
https://git.kernel.org/stable/c/3590498117a11aa1f92a97e8a04d95320e347ebd
https://git.kernel.org/stable/c/7f12f99b8017ad5ed5aff4b0aefe3bb7bbdf8a99
https://git.kernel.org/stable/c/baef27176ea5fdc7ad0947e2dc7733855e35db71
https://git.kernel.org/stable/c/d23f65f08247068576a01e28b297e995b7dc3965
https://git.kernel.org/stable/c/32854bc91ae7debcdefdc7ae881ed83385a04792
https://git.kernel.org/stable/c/734a3deb6614e3597e7e9ef7fb6006c593c5ee18
https://git.kernel.org/stable/c/98e5eb110095ec77cb6d775051d181edbf9cd3cf

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.