CVE-2026-72303

HighCVSS 7.8

Published: 15/08/2026(UTC)Updated: 17/08/2026(UTC)Translated: 15/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

5th percentile - higher than 5% of all known CVEs

Summary

In the Linux kernel, there is a missing validation of the MODULE_NOTIFICATION payload size before reading bytes/channel data in control update handling.

Risk Assessment

Missing validation could lead to out-of-bounds read, potentially causing system crash or privilege escalation.

Recommendation

Install the kernel patch that adds validation of the notification payload size.

Original NVD description (English source)

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-control: Validate notification payload size Validate MODULE_NOTIFICATION payload length before reading bytes/channel data in control update handling.