CVE-2026-99182
Received Received - Intake

BaseFortify

Publication date: 2026-10-28

Last updated on: 2026-10-28

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture When ch_count is smaller than blob->alh_cfg.device_count (e.g. a mono capture stream, such as a SmartMic, aggregated across multiple SDW links), step = ch_count / blob->alh_cfg.device_count truncates to 0. The subsequent GENMASK(step - 1, 0) then underflows step - 1 (u32) to UINT_MAX, causing GENMASK()'s internal shift to use an out-of-bounds exponent: UBSAN: shift-out-of-bounds in sound/soc/sof/ipc4-topology.c:2363:13 shift exponent 18446744069414584384 is too large for 64-bit type 'long unsigned int' Treat ch_count < device_count the same way as the existing "channels equal to output reference channels" case: apply the same ch_mask to every aggregated device instead of trying to split channels that can't be evenly divided.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-28
Last Modified
2026-10-28
Generated
2026-10-28
AI Q&A
2026-10-28
EPSS Evaluated
N/A
NVD
CVE-2026-99182
EUVD
EUVD-2026-111934

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Linux Linux 0390a102cc18cb7456d6c1f15ac51f1af90fcf9c
Linux Linux 0390a102cc18cb7456d6c1f15ac51f1af90fcf9c
Linux Linux 0390a102cc18cb7456d6c1f15ac51f1af90fcf9c
Linux Linux 6.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a shift-out-of-bounds error in the ASoC (ALSA System on Chip) Sound Open Firmware (SOF) IPC4 topology handling. When a mono capture stream (e.g., a SmartMic) is aggregated across multiple SDW links but the channel count is smaller than the device count, a division operation results in a zero value. This causes an underflow in a subsequent bitmask operation, leading to an invalid shift exponent and a kernel panic due to undefined behavior.

Detection Guidance

This vulnerability is specific to the Linux kernel's ASoC SOF IPC4 topology component and cannot be detected via network scans or general system commands. It requires kernel-level inspection for shift-out-of-bounds errors in sound/soc/sof/ipc4-topology.c. Check kernel logs for UBSAN warnings related to shift operations in this module.

Impact Analysis

This vulnerability can cause system instability or crashes (kernel panics) when processing audio streams with specific configurations. It may affect systems using the Linux kernel with SOF audio drivers, particularly those with mono capture streams aggregated across multiple links. Users might experience audio device failures or system freezes under these conditions.

Mitigation Strategies

Update your Linux kernel to a patched version that includes the fix for this issue. Monitor kernel logs for UBSAN errors related to sound/soc/sof/ipc4-topology.c. If using affected configurations (mono capture streams across multiple SDW links), avoid such setups until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-99182. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart