CVE-2026-72261
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
In the Linux kernel, a missing size validation was found in ASoC SOF ipc3-control in snd_sof_update_control. The firmware-provided cdata->num_elems is checked against local_cdata->data->size but never against the actual allocation size. If local_cdata->data->size was previously set to an inconsistent value, the memcpy could write past the allocated buffer. The fix adds a bounds check to ensure num_elems fits within the available space in the ipc_control_data allocation.
Risk Assessment
Missing size validation can lead to out-of-bounds write, potentially resulting in memory corruption, system crash, or privilege escalation.
Recommendation
It is recommended to update the Linux kernel to a version containing the fix that adds a bounds check in snd_sof_update_control.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control In snd_sof_update_control(), firmware-provided cdata->num_elems is checked against local_cdata->data->size but never against the actual allocation size. If local_cdata->data->size was previously set to an inconsistent value, the memcpy could write past the allocated buffer. Add a bounds check to ensure num_elems fits within the available space in the ipc_control_data allocation before copying.