Local kernel buffer overflow via inflated snprintf length

Buffer overflow in Linux kernel 5.19 through 5.19.3 allows local users to trigger a kernel overrun through an AVS topology-name read. In topology_name_read() in sound/soc/intel/avs/pcm.c, snprintf() can return a length beyond its 64-byte stack buffer, and simple_read_from_buffer() then uses that inflated length. A low-privileged local user must reach the AVS topology read path; the Linux kernel CVE team describes the overflow as unrealistic and reports no demonstrated exploit.