Riskcovery

CVE-2026-72302

ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc

State
Published
Severity
7.8 High
Published
Aug 15, 2026
Updated
Oct 16, 2026
Reserved
Aug 9, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc

In sof_ipc3_control_update(), the expected_size calculation uses firmware-provided cdata->num_elems in arithmetic that could overflow on 32-bit platforms, wrapping to a small value. This would allow the cdata->rhdr.hdr.size comparison to pass with mismatched sizes, potentially leading to out-of-bounds access in snd_sof_update_control.

Use check_mul_overflow() and check_add_overflow() to detect and reject overflowed size calculations.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 10f461d79c2d1afb22344986cc1b4631169cf25e to before 6856b3c23b0995eefad5a6142b4365ef70e1fe4aAffected
  • 10f461d79c2d1afb22344986cc1b4631169cf25e to before 89a2309a9eec80d4c19e3aed62c4f923594d1911Affected
  • 10f461d79c2d1afb22344986cc1b4631169cf25e to before ffd79e77f2fbacd7a5d40ad1d4c7f3f089a8f2f3Affected
  • 10f461d79c2d1afb22344986cc1b4631169cf25e to before 711d912b18763af62a63aa8f2419a774eb63bba4Affected
  • 10f461d79c2d1afb22344986cc1b4631169cf25e to before 312c7d2ebe696da3f885eee77d52297664e57c53Affected
  • 10f461d79c2d1afb22344986cc1b4631169cf25e to before 8791977d7289f6e9d2b014f60a5455f053a7bc04Affected
LinuxLinux
  • 5.18Affected
  • before 5.18Not affected
  • 6.1.178 through 6.1.*Not affected
  • 6.6.145 through 6.6.*Not affected
  • 6.12.97 through 6.12.*Not affected
  • 6.18.40 through 6.18.*Not affected
  • 7.1.5 through 7.1.*Not affected
  • 7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.