CVE-2026-72488
Received Received - Intake

Linux kernel Out-of-Bounds Access in SoundWire

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: soundwire: fix bug in sdw_add_element_group_count found by syzkaller The original implementation caused an out-of-bounds memory access in the sdw_add_element_group_count for-loop when i == num. for (i = 0; i <= num; i++) { if (rate == group->rates[i] && lane == group->lanes[i]) ... To fix this error, the function now checks for existing rate/lane entries in the group(a function parameter) using a for-loop before adding them. No functional changes apart from this fix.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72488
EUVD
EUVD-2026-59387

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where an out-of-bounds memory access occurs in the soundwire subsystem. The bug is in the sdw_add_element_group_count function, which incorrectly uses a loop condition that allows i to reach num, causing it to access memory beyond the intended array bounds.

Detection Guidance

This vulnerability is specific to the Linux kernel's soundwire subsystem and involves an out-of-bounds memory access. Detection requires checking kernel logs for memory access errors or crashes related to soundwire. Commands like dmesg | grep -i soundwire or journalctl -k | grep -i soundwire may help identify issues.

Impact Analysis

This vulnerability could lead to system crashes, memory corruption, or potential privilege escalation if exploited. It may cause instability in systems using the soundwire subsystem, particularly those with audio or communication hardware relying on this interface.

Mitigation Strategies

Apply the latest kernel update from your Linux distribution to patch the soundwire bug. If immediate patching is not possible, consider disabling the soundwire subsystem if not required, though this may impact audio functionality.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72488. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart