CVE-2026-72302
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
In the Linux kernel, the sof_ipc3_control_update() function calculates expected_size using firmware-provided num_elems, which can overflow on 32-bit platforms. This could allow size comparison to pass with mismatched sizes, potentially leading to out-of-bounds access.
Risk Assessment
Overflow could allow an attacker to access out-of-bounds memory, potentially causing system crash or privilege escalation.
Recommendation
Apply the kernel patch that uses check_mul_overflow() and check_add_overflow() to detect and reject overflowed size calculations.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc In sof_ipc3_control_update(), the expected_size calculation uses firmware-provided cdata->num_elems in arithmetic that could overflow on 32-bit platforms, wrapping to a small value. This would allow the cdata->rhdr.hdr.size comparison to pass with mismatched sizes, potentially leading to out-of-bounds access in snd_sof_update_control. Use check_mul_overflow() and check_add_overflow() to detect and reject overflowed size calculations.