CVE-2026-46088

In the Linux kernel, the following vulnerability has been resolved:

ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names()

snd_ctl_elem_init_enum_names() advances pointer p through the names

buffer while decrementing buf_len. If buf_len reaches zero but items

remain, the next iteration calls strnlen(p, 0).

While strnlen(p, 0) returns 0 and would hit the existing name_len == 0

error path, CONFIG_FORTIFY_SOURCE's fortified strnlen() first checks

maxlen against __builtin_dynamic_object_size(). When Clang loses track

of p's object size inside the loop, this triggers a BRK exception panic

before the return value is examined.

Add a buf_len == 0 guard at the loop entry to prevent calling fortified

strnlen() on an exhausted buffer.

Found by kernel fuzz testing through Xiaomi Smartphone.