CVE-2026-72302
Received Received - Intake

Linux kernel ASoC SOF Control Size Overflow

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc In sof_ipc3_control_update(), the expected_size calculation uses firmware-provided cdata->num_elems in arithmetic that could overflow on 32-bit platforms, wrapping to a small value. This would allow the cdata->rhdr.hdr.size comparison to pass with mismatched sizes, potentially leading to out-of-bounds access in snd_sof_update_control. Use check_mul_overflow() and check_add_overflow() to detect and reject overflowed size calculations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72302
EUVD
EUVD-2026-59201

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a vulnerability in the Linux kernel's ASoC (ALSA System on Chip) Sound Open Firmware (SOF) subsystem. It involves a potential integer overflow in the sof_ipc3_control_update function when calculating expected_size using firmware-provided num_elems on 32-bit platforms. This could lead to incorrect size comparisons and out-of-bounds memory access in snd_sof_update_control.

Detection Guidance

This vulnerability is specific to the Linux kernel's ASoC SOF subsystem and requires kernel-level inspection. Detection involves checking kernel logs for related errors or examining the kernel source code for the affected function sof_ipc3_control_update. No direct network detection commands are applicable.

Impact Analysis

If exploited, this vulnerability could allow an attacker to cause memory corruption or execute arbitrary code in the kernel. This might lead to system crashes, privilege escalation, or unauthorized access to sensitive data. Systems using affected Linux kernel versions with ASoC SOF support are at risk.

Mitigation Strategies

Apply the latest Linux kernel security patches that address this issue. If using a distribution kernel, update to the patched version. For custom kernels, ensure the fix for CVE-2026-72302 is included in your build.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72302. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart