CVE-2026-72488
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
In the Linux kernel, in the soundwire subsystem, the sdw_add_element_group_count function had an out-of-bounds memory access in the for-loop when i == num. The fix adds a check for existing rate/lane entries before adding them, with no functional changes apart from this fix.
Risk Assessment
Out-of-bounds memory access can lead to system crashes or security breaches, especially in environments with untrusted data.
Recommendation
Apply the Linux kernel update containing this fix to prevent out-of-bounds access in the soundwire subsystem.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: soundwire: fix bug in sdw_add_element_group_count found by syzkaller The original implementation caused an out-of-bounds memory access in the sdw_add_element_group_count for-loop when i == num. for (i = 0; i <= num; i++) { if (rate == group->rates[i] && lane == group->lanes[i]) ... To fix this error, the function now checks for existing rate/lane entries in the group(a function parameter) using a for-loop before adding them. No functional changes apart from this fix.