CVE-2026-72263

Received Received - Intake

Memory Leak in Linux Kernel ASoC SOF Topology

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: topology: fix memory leak in snd_sof_load_topology When the topology filename contains "dummy" and tplg_cnt is 0, the function returns -EINVAL directly without freeing the tplg_files allocated by kcalloc() at line 2497. This leaks memory on every such topology load attempt. Fix this by setting ret = -EINVAL and jumping to the out: label, which already handles the kfree(tplg_files) cleanup.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72263

EUVD

EUVD-2026-59162

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a memory leak vulnerability in the Linux kernel's Advanced Linux Sound Architecture (ALSA) Sound Open Firmware (SOF) topology component. When a topology filename contains the word 'dummy' and a counter variable is zero, the function exits early without freeing allocated memory, causing a leak on every attempt to load such a topology.

Detection Guidance

This vulnerability is specific to the Linux kernel's ASoC SOF topology component. Detection requires checking kernel logs for topology loading errors or memory leaks related to snd_sof_load_topology. Use commands like dmesg | grep -i "sof" or journalctl -k | grep -i "topology" to inspect kernel logs for relevant errors.

Impact Analysis

The memory leak could gradually consume system memory over time, potentially leading to degraded performance or crashes in audio-related applications. However, the impact is limited to systems using the SOF topology feature with specific filename patterns.

Compliance Impact

This vulnerability causes a memory leak in the Linux kernel's ASoC SOF topology component when processing specific topology files. While it does not directly impact data privacy or security controls required by standards like GDPR or HIPAA, memory leaks can lead to system instability or denial-of-service conditions, which may indirectly affect compliance by disrupting required security or operational controls.

Mitigation Strategies

Apply the kernel patch that fixes the memory leak in snd_sof_load_topology. Update to a Linux kernel version that includes the fix. Monitor kernel logs for topology loading errors after applying the patch.

Hi! I’m here to help you understand CVE-2026-72263. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70