CVE-2026-72488

soundwire: fix bug in sdw_add_element_group_count found by syzkaller

State: Published
Severity: 7.8 High
Published: Aug 15, 2026
Updated: Oct 30, 2026
Reserved: Aug 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

soundwire: fix bug in sdw_add_element_group_count found by syzkaller

The original implementation caused an out-of-bounds memory access in the sdw_add_element_group_count for-loop when i == num.

for (i = 0; i <= num; i++) { if (rate == group->rates[i] && lane == group->lanes[i]) ...

To fix this error, the function now checks for existing rate/lane entries in the group(a function parameter) using a for-loop before adding them.

No functional changes apart from this fix.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	9026118f20e28f202dab34f219bbb831ffb8c4dc to before c35474cf6a7d0891ebebbeda08ce34b602885ab6Affected 9026118f20e28f202dab34f219bbb831ffb8c4dc to before a2275dce05e6d1cce69bf68f23ea7a63c0c54baeAffected 9026118f20e28f202dab34f219bbb831ffb8c4dc to before 5c3ce6d3559ce57e6c3108aa9ecf7b32764188c5Affected 9026118f20e28f202dab34f219bbb831ffb8c4dc to before a454f61747c97e2eadaa7a35ffc1f4b1645c6a53Affected 9026118f20e28f202dab34f219bbb831ffb8c4dc to before e483a406a23a92d5202e8d324f206e127eef48ffAffected 9026118f20e28f202dab34f219bbb831ffb8c4dc to before f772ff5a0e6758fd412803c09e03ba3bca5f5878Affected
LinuxLinux	5.10Affected before 5.10Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.114 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

9026118f20e28f202dab34f219bbb831ffb8c4dc to before c35474cf6a7d0891ebebbeda08ce34b602885ab6Affected
9026118f20e28f202dab34f219bbb831ffb8c4dc to before a2275dce05e6d1cce69bf68f23ea7a63c0c54baeAffected
9026118f20e28f202dab34f219bbb831ffb8c4dc to before 5c3ce6d3559ce57e6c3108aa9ecf7b32764188c5Affected
9026118f20e28f202dab34f219bbb831ffb8c4dc to before a454f61747c97e2eadaa7a35ffc1f4b1645c6a53Affected
9026118f20e28f202dab34f219bbb831ffb8c4dc to before e483a406a23a92d5202e8d324f206e127eef48ffAffected
9026118f20e28f202dab34f219bbb831ffb8c4dc to before f772ff5a0e6758fd412803c09e03ba3bca5f5878Affected

LinuxLinux

5.10Affected
before 5.10Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.114 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.