# greybus: audio: bound the topology section sizes against the fetched size

CVE record · `CVE-2026-93280`

- **Identifiers:** `CVE-2026-93280`
- **State:** Confirmed
- **Severity:** CVSS 8.8 High
- **Critical:** No
- **CNA:** Linux
- **Technologies:** [Linux kernel](https://agentprime.io/advisories/technology/linux-kernel.md)
- **Published:** 24 Sept 2026
- **Updated:** 19 Oct 2026
- **Reviewed by a person:** No

Published by the CVE Program (CNA: Linux) at 24 Sept 2026, 15:52 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

## Affected products, as the CNA wrote them

- Vendor: Linux. Product: Linux.
  - affected: `184992e305f1de3a3d5fa446da3a2bc76be7c54a to before ba86de9f7b0d7903d2df5ea2373e34d8ca3fc43e` (git)
  - affected: `184992e305f1de3a3d5fa446da3a2bc76be7c54a to before dd5593aee0a0fb353e1164aff7b65e563fe1f232` (git)
  - affected: `184992e305f1de3a3d5fa446da3a2bc76be7c54a to before 6f764363b3173d805be11e59a8f23ecee2d420d5` (git)
  - affected: `184992e305f1de3a3d5fa446da3a2bc76be7c54a to before 52daf9de692ebac813d110eb1e677dc0e1f4a5ab` (git)
  - affected: `184992e305f1de3a3d5fa446da3a2bc76be7c54a to before d0f6eaba60705bacd9bb4ce48eab50ef3f546777` (git)
  - affected: `184992e305f1de3a3d5fa446da3a2bc76be7c54a to before c9191f2e2f35f1209eb2dc24b31129dd47b48c16` (git)
  - affected: `184992e305f1de3a3d5fa446da3a2bc76be7c54a to before cfcc5a41a9664eb68023aae4cd0d485b256bd7c7` (git)
  - affected: `184992e305f1de3a3d5fa446da3a2bc76be7c54a to before 33d8c7b794d2a30637c9d3fcb478f1d3222bef1e` (git)
  - Other versions: unaffected
- Vendor: Linux. Product: Linux.
  - affected: `4.9`
  - unaffected: `before 4.9` (semver)
  - unaffected: `5.10.270 to 5.10.*, inclusive` (semver)
  - unaffected: `5.15.221 to 5.15.*, inclusive` (semver)
  - unaffected: `6.1.188 to 6.1.*, inclusive` (semver)
  - unaffected: `6.6.157 to 6.6.*, inclusive` (semver)
  - unaffected: `6.12.110 to 6.12.*, inclusive` (semver)
  - unaffected: `6.18.52 to 6.18.*, inclusive` (semver)
  - unaffected: `7.2.6 to 7.2.*, inclusive` (semver)
  - unaffected: `7.3 to *, inclusive` (original_commit_for_fix)
  - Other versions: affected

## Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

## Severity and exploitation

- 8.8 High, CVSS 3.1: `CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, from CNA (Linux)

- **CISA KEV:** Not listed.
- **EPSS:** 0.0032, the 25th percentile, on 13 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

## Timeline

This record came from the full history of the CVE Program, published 24 Sept 2026. New records show when each source confirmed them.

## Sources

- [CVE List: CVE-2026-93280](https://www.cve.org/CVERecord?id=CVE-2026-93280)
- [NVD: CVE-2026-93280](https://nvd.nist.gov/vuln/detail/CVE-2026-93280)

### References from the CNA

- <https://git.kernel.org/stable/c/ba86de9f7b0d7903d2df5ea2373e34d8ca3fc43e>
- <https://git.kernel.org/stable/c/dd5593aee0a0fb353e1164aff7b65e563fe1f232>
- <https://git.kernel.org/stable/c/6f764363b3173d805be11e59a8f23ecee2d420d5>
- <https://git.kernel.org/stable/c/52daf9de692ebac813d110eb1e677dc0e1f4a5ab>
- <https://git.kernel.org/stable/c/d0f6eaba60705bacd9bb4ce48eab50ef3f546777>
- <https://git.kernel.org/stable/c/c9191f2e2f35f1209eb2dc24b31129dd47b48c16>
- <https://git.kernel.org/stable/c/cfcc5a41a9664eb68023aae4cd0d485b256bd7c7>
- <https://git.kernel.org/stable/c/33d8c7b794d2a30637c9d3fcb478f1d3222bef1e>

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.

## Check whether this affects you

This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. Compare the affected versions above with what you run.

- With the agentprime MCP server (<https://api.agentprime.io/mcp>), `get_advisory` returns this record and `search_advisories` finds related ones. Setup: <https://agentprime.io/mcp.md>
- As JSON: <https://api.agentprime.io/v1/advisories/CVE-2026-93280>
- Everything that needs attention now: <https://agentprime.io/advisories/critical.md>

---

The web page: <https://agentprime.io/advisories/CVE-2026-93280/>. Everything for agents: <https://agentprime.io/llms.txt>.