GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-72304 (GCVE-0-2026-72304)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:55 – Updated: 2026-08-17 05:42
VLAI
Title
ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put
Summary
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put In sof_ipc4_bytes_put(), the copy size is derived from the old data->size in the buffer rather than the incoming new data's size field from ucontrol. If the new data has a different size, the copy uses the wrong length: it may truncate valid data or copy stale bytes. Fix by validating and using the incoming data's sof_abi_hdr.size from ucontrol before copying.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: a062c8899fede2ab5660a817e9b602d3fa280a99 , < 266f936db83aee6ca6473bbb06259bda52bf4fc3 (git)
Affected: a062c8899fede2ab5660a817e9b602d3fa280a99 , < 4cf6a7ebbf8787393b158b2cc341723e5bebc4a8 (git)
Affected: a062c8899fede2ab5660a817e9b602d3fa280a99 , < fb4293173db2d474d8fbc0e5ecf4943e6df2b40e (git)
Affected: a062c8899fede2ab5660a817e9b602d3fa280a99 , < 038406abde0d0883419ec89425ea941ec8bbef95 (git)
Affected: a062c8899fede2ab5660a817e9b602d3fa280a99 , < 3ad673e7139cf214afd24321a829aad6575f4163 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.4
Unaffected: 0 , < 6.4 (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/soc/sof/ipc4-control.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "266f936db83aee6ca6473bbb06259bda52bf4fc3",
              "status": "affected",
              "version": "a062c8899fede2ab5660a817e9b602d3fa280a99",
              "versionType": "git"
            },
            {
              "lessThan": "4cf6a7ebbf8787393b158b2cc341723e5bebc4a8",
              "status": "affected",
              "version": "a062c8899fede2ab5660a817e9b602d3fa280a99",
              "versionType": "git"
            },
            {
              "lessThan": "fb4293173db2d474d8fbc0e5ecf4943e6df2b40e",
              "status": "affected",
              "version": "a062c8899fede2ab5660a817e9b602d3fa280a99",
              "versionType": "git"
            },
            {
              "lessThan": "038406abde0d0883419ec89425ea941ec8bbef95",
              "status": "affected",
              "version": "a062c8899fede2ab5660a817e9b602d3fa280a99",
              "versionType": "git"
            },
            {
              "lessThan": "3ad673e7139cf214afd24321a829aad6575f4163",
              "status": "affected",
              "version": "a062c8899fede2ab5660a817e9b602d3fa280a99",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/soc/sof/ipc4-control.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put\n\nIn sof_ipc4_bytes_put(), the copy size is derived from the old\ndata-\u003esize in the buffer rather than the incoming new data\u0027s size\nfield from ucontrol. If the new data has a different size, the copy\nuses the wrong length: it may truncate valid data or copy stale bytes.\n\nFix by validating and using the incoming data\u0027s sof_abi_hdr.size from\nucontrol before copying."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached via SNDRV_CTL_IOCTL_ELEM_WRITE on /dev/snd/controlC* through snd_ctl_elem_write_user() -\u003e snd_sof_bytes_put() -\u003e sof_ipc4_bytes_put(); SOF IPC4 bytes controls are a local ALSA ioctl path, not a network-facing service.\nAC:L - An attacker reliably triggers the flaw with two self-controlled ALSA writes: first establish a small cached data-\u003esize, then submit a ucontrol whose sof_abi_hdr.size differs; no race against unrelated victim state is required.\nPR:L - Only a local user who can open ALSA control devices on SOF-equipped Intel laptop/desktop audio hardware is required; typical desktop users in the audio group have this access without real root or init-namespace capabilities.\nUI:N - No separate victim action is needed; the attacker issues the control-element write ioctls directly to drive the vulnerable copy and subsequent IPC transmission.\nS:U - Impact is confined to the host kernel SOF/ALSA audio subsystem on the same machine; heap disclosure, IPC misuse, or firmware parameter corruption does not cross VM, container, or IOMMU boundaries.\nC:H - Validating and copying against stale data-\u003esize lets attacker-controlled new_hdr-\u003esize bypass bounds checks, so sof_ipc4_set_get_bytes_data() and IPC helpers read beyond the kmalloc control buffer, disclosing adjacent kernel heap memory.\nI:H - The mismatched copy leaves attacker-influenced stale kernel bytes in control buffers and forwards unvalidated sizes to firmware IPC (including sof_ipc4_set_bytes_control_data() memcpy paths), enabling bounded but attacker-directed kernel memory corruption.\nA:H - Inflated unvalidated data-\u003esize values drive large memcpy/IPC loops past the allocated control payload, which can provoke KASAN faults, unhandled page faults, kernel oops, or panic on SOF systems."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:42:37.543Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/266f936db83aee6ca6473bbb06259bda52bf4fc3"
        },
        {
          "url": "https://git.kernel.org/stable/c/4cf6a7ebbf8787393b158b2cc341723e5bebc4a8"
        },
        {
          "url": "https://git.kernel.org/stable/c/fb4293173db2d474d8fbc0e5ecf4943e6df2b40e"
        },
        {
          "url": "https://git.kernel.org/stable/c/038406abde0d0883419ec89425ea941ec8bbef95"
        },
        {
          "url": "https://git.kernel.org/stable/c/3ad673e7139cf214afd24321a829aad6575f4163"
        }
      ],
      "title": "ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72304",
    "datePublished": "2026-08-15T05:55:22.290Z",
    "dateReserved": "2026-08-09T03:40:39.918Z",
    "dateUpdated": "2026-08-17T05:42:37.543Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72304",
      "date": "2026-09-16",
      "epss": "0.00163",
      "percentile": "0.05937"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-72304\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T06:22:03.120\",\"lastModified\":\"2026-08-17T06:18:33.467\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put\\n\\nIn sof_ipc4_bytes_put(), the copy size is derived from the old\\ndata-\u003esize in the buffer rather than the incoming new data\u0027s size\\nfield from ucontrol. If the new data has a different size, the copy\\nuses the wrong length: it may truncate valid data or copy stale bytes.\\n\\nFix by validating and using the incoming data\u0027s sof_abi_hdr.size from\\nucontrol before copying.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"sound/soc/sof/ipc4-control.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"a062c8899fede2ab5660a817e9b602d3fa280a99\",\"lessThan\":\"266f936db83aee6ca6473bbb06259bda52bf4fc3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a062c8899fede2ab5660a817e9b602d3fa280a99\",\"lessThan\":\"4cf6a7ebbf8787393b158b2cc341723e5bebc4a8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a062c8899fede2ab5660a817e9b602d3fa280a99\",\"lessThan\":\"fb4293173db2d474d8fbc0e5ecf4943e6df2b40e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a062c8899fede2ab5660a817e9b602d3fa280a99\",\"lessThan\":\"038406abde0d0883419ec89425ea941ec8bbef95\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a062c8899fede2ab5660a817e9b602d3fa280a99\",\"lessThan\":\"3ad673e7139cf214afd24321a829aad6575f4163\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"sound/soc/sof/ipc4-control.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.4\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.4\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.145\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.97\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.40\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/038406abde0d0883419ec89425ea941ec8bbef95\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/266f936db83aee6ca6473bbb06259bda52bf4fc3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3ad673e7139cf214afd24321a829aad6575f4163\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4cf6a7ebbf8787393b158b2cc341723e5bebc4a8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fb4293173db2d474d8fbc0e5ecf4943e6df2b40e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-18T21:43:22+00:00",
      "cve": "CVE-2026-72304",
      "id": "CVE-2026-72304",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72304.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-01T13:30:33Z",
      "cve": "CVE-2026-72304",
      "id": "CVE-2026-72304",
      "initial_release_date": "2026-09-01T13:30:33Z",
      "product_status:known_affected": "82",
      "product_status:known_not_affected": "280",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72304",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72304.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.