CVE-2026-93280 (GCVE-0-2026-93280)

Vulnerability from cvelistv5 – Published: 2026-09-24 15:52 – Updated: 2026-09-25 05:09
VLAI
Title
greybus: audio: bound the topology section sizes against the fetched size
Summary
In the Linux kernel, the following vulnerability has been resolved: greybus: audio: bound the topology section sizes against the fetched size gb_audio_gb_get_topology() fetches a topology blob of a module-supplied size, and gbaudio_tplg_parse_data() then walks it by adding the module-supplied size_dais, size_controls and size_widgets fields to form the control, widget and route section offsets. Those le32 sizes are never checked against the fetched blob, so a module reporting a small topology size but large section sizes makes the offsets point past the allocation, and parsing reads out of bounds. Reject a topology whose section sizes do not fit within the fetched size before it is parsed.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 184992e305f1de3a3d5fa446da3a2bc76be7c54a , < ba86de9f7b0d7903d2df5ea2373e34d8ca3fc43e (git)
Affected: 184992e305f1de3a3d5fa446da3a2bc76be7c54a , < dd5593aee0a0fb353e1164aff7b65e563fe1f232 (git)
Affected: 184992e305f1de3a3d5fa446da3a2bc76be7c54a , < 6f764363b3173d805be11e59a8f23ecee2d420d5 (git)
Affected: 184992e305f1de3a3d5fa446da3a2bc76be7c54a , < 52daf9de692ebac813d110eb1e677dc0e1f4a5ab (git)
Affected: 184992e305f1de3a3d5fa446da3a2bc76be7c54a , < d0f6eaba60705bacd9bb4ce48eab50ef3f546777 (git)
Affected: 184992e305f1de3a3d5fa446da3a2bc76be7c54a , < c9191f2e2f35f1209eb2dc24b31129dd47b48c16 (git)
Affected: 184992e305f1de3a3d5fa446da3a2bc76be7c54a , < cfcc5a41a9664eb68023aae4cd0d485b256bd7c7 (git)
Affected: 184992e305f1de3a3d5fa446da3a2bc76be7c54a , < 33d8c7b794d2a30637c9d3fcb478f1d3222bef1e (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.9
Unaffected: 0 , < 4.9 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.52 , ≤ 6.18.* (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/staging/greybus/audio_gb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ba86de9f7b0d7903d2df5ea2373e34d8ca3fc43e",
              "status": "affected",
              "version": "184992e305f1de3a3d5fa446da3a2bc76be7c54a",
              "versionType": "git"
            },
            {
              "lessThan": "dd5593aee0a0fb353e1164aff7b65e563fe1f232",
              "status": "affected",
              "version": "184992e305f1de3a3d5fa446da3a2bc76be7c54a",
              "versionType": "git"
            },
            {
              "lessThan": "6f764363b3173d805be11e59a8f23ecee2d420d5",
              "status": "affected",
              "version": "184992e305f1de3a3d5fa446da3a2bc76be7c54a",
              "versionType": "git"
            },
            {
              "lessThan": "52daf9de692ebac813d110eb1e677dc0e1f4a5ab",
              "status": "affected",
              "version": "184992e305f1de3a3d5fa446da3a2bc76be7c54a",
              "versionType": "git"
            },
            {
              "lessThan": "d0f6eaba60705bacd9bb4ce48eab50ef3f546777",
              "status": "affected",
              "version": "184992e305f1de3a3d5fa446da3a2bc76be7c54a",
              "versionType": "git"
            },
            {
              "lessThan": "c9191f2e2f35f1209eb2dc24b31129dd47b48c16",
              "status": "affected",
              "version": "184992e305f1de3a3d5fa446da3a2bc76be7c54a",
              "versionType": "git"
            },
            {
              "lessThan": "cfcc5a41a9664eb68023aae4cd0d485b256bd7c7",
              "status": "affected",
              "version": "184992e305f1de3a3d5fa446da3a2bc76be7c54a",
              "versionType": "git"
            },
            {
              "lessThan": "33d8c7b794d2a30637c9d3fcb478f1d3222bef1e",
              "status": "affected",
              "version": "184992e305f1de3a3d5fa446da3a2bc76be7c54a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/staging/greybus/audio_gb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.9"
            },
            {
              "lessThan": "4.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngreybus: audio: bound the topology section sizes against the fetched size\n\ngb_audio_gb_get_topology() fetches a topology blob of a module-supplied\nsize, and gbaudio_tplg_parse_data() then walks it by adding the\nmodule-supplied size_dais, size_controls and size_widgets fields to\nform the control, widget and route section offsets. Those le32 sizes\nare never checked against the fetched blob, so a module reporting a\nsmall topology size but large section sizes makes the offsets point\npast the allocation, and parsing reads out of bounds.\n\nReject a topology whose section sizes do not fit within the fetched\nsize before it is parsed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The malformed bytes are size_dais/size_controls/size_widgets in the GB_AUDIO_TYPE_GET_TOPOLOGY response that gb_audio_probe() fetches via gb_audio_gb_get_topology()\u2192gb_operation_sync(); on BeaglePlay that Greybus payload is delivered by hdlc_rx_greybus_frame() from the CC1352 802.15.4 SVC, so a radio-range module supplies the blob, not a routable IP peer.\nAC:L - A module that returns a small GET_TOPOLOGY_SIZE and then oversized le32 size_* fields makes gbaudio_tplg_process_header() compute control_offset/widget_offset past the kzalloc() blob on every gb_audio_probe(); the attacker fully controls those fields and no race or uninfluenced host state is required.\nPR:N - gb_svc_process_module_inserted()\u2192gb_module_add()\u2192gb_interface_enable()\u2192greybus_probe()\u2192gb_audio_probe() runs with no capable() or host-uid check, and CAP authentication is a separate optional ioctl, not a gate on this path; the attacking module needs no Linux account.\nUI:N - gb_audio_probe() itself calls gb_audio_gb_get_topology() and gbaudio_tplg_parse_data() as soon as a GREYBUS_CLASS_AUDIO bundle is registered; no victim ioctl, ALSA open, or mount is required.\nS:U - The over-read and snprintf() stores corrupt the host kernel topology allocation and adjacent slab inside the same kernel authority; this is not a KVM/Xen guest-to-host escape or an IOMMU/DMA bypass.\nC:H - gbaudio_tplg_process_kcontrols() and gbaudio_tplg_create_widget() read gb_audio_control/widget fields from the OOB offset, and gb_generate_enum_strings() walks names with an unbounded while (*data != \u0027\\0\u0027) past the blob, disclosing adjacent kernel heap (and those strings can later appear as ALSA enum names).\nI:H - With curr/w pointing past the topology object, snprintf(curr-\u003ename, sizeof(curr-\u003ename), \"GB %d %s\", ...) in gbaudio_tplg_process_kcontrols() and snprintf(w-\u003ename, ...) in gbaudio_tplg_create_widget() perform 32-byte out-of-bounds writes at an attacker-chosen size_dais+size_controls offset, a heap write primitive.\nA:H - Walking those OOB control/widget pointers and the unbounded enum-name scan can fault on an unmapped page during gb_audio_probe() and oops the kernel; the module can re-insert to repeat it."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T05:09:57.962Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ba86de9f7b0d7903d2df5ea2373e34d8ca3fc43e"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd5593aee0a0fb353e1164aff7b65e563fe1f232"
        },
        {
          "url": "https://git.kernel.org/stable/c/6f764363b3173d805be11e59a8f23ecee2d420d5"
        },
        {
          "url": "https://git.kernel.org/stable/c/52daf9de692ebac813d110eb1e677dc0e1f4a5ab"
        },
        {
          "url": "https://git.kernel.org/stable/c/d0f6eaba60705bacd9bb4ce48eab50ef3f546777"
        },
        {
          "url": "https://git.kernel.org/stable/c/c9191f2e2f35f1209eb2dc24b31129dd47b48c16"
        },
        {
          "url": "https://git.kernel.org/stable/c/cfcc5a41a9664eb68023aae4cd0d485b256bd7c7"
        },
        {
          "url": "https://git.kernel.org/stable/c/33d8c7b794d2a30637c9d3fcb478f1d3222bef1e"
        }
      ],
      "title": "greybus: audio: bound the topology section sizes against the fetched size",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-93280",
    "datePublished": "2026-09-24T15:52:22.253Z",
    "dateReserved": "2026-09-17T16:02:15.098Z",
    "dateUpdated": "2026-09-25T05:09:57.962Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/staging/greybus/audio_gb.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "ba86de9f7b0d7903d2df5ea2373e34d8ca3fc43e",
                    "status": "affected",
                    "version": "184992e305f1de3a3d5fa446da3a2bc76be7c54a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "dd5593aee0a0fb353e1164aff7b65e563fe1f232",
                    "status": "affected",
                    "version": "184992e305f1de3a3d5fa446da3a2bc76be7c54a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6f764363b3173d805be11e59a8f23ecee2d420d5",
                    "status": "affected",
                    "version": "184992e305f1de3a3d5fa446da3a2bc76be7c54a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "52daf9de692ebac813d110eb1e677dc0e1f4a5ab",
                    "status": "affected",
                    "version": "184992e305f1de3a3d5fa446da3a2bc76be7c54a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d0f6eaba60705bacd9bb4ce48eab50ef3f546777",
                    "status": "affected",
                    "version": "184992e305f1de3a3d5fa446da3a2bc76be7c54a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c9191f2e2f35f1209eb2dc24b31129dd47b48c16",
                    "status": "affected",
                    "version": "184992e305f1de3a3d5fa446da3a2bc76be7c54a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cfcc5a41a9664eb68023aae4cd0d485b256bd7c7",
                    "status": "affected",
                    "version": "184992e305f1de3a3d5fa446da3a2bc76be7c54a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "33d8c7b794d2a30637c9d3fcb478f1d3222bef1e",
                    "status": "affected",
                    "version": "184992e305f1de3a3d5fa446da3a2bc76be7c54a",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/staging/greybus/audio_gb.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.9"
                  },
                  {
                    "lessThan": "4.9",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.270",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.221",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.110",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.52",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngreybus: audio: bound the topology section sizes against the fetched size\n\ngb_audio_gb_get_topology() fetches a topology blob of a module-supplied\nsize, and gbaudio_tplg_parse_data() then walks it by adding the\nmodule-supplied size_dais, size_controls and size_widgets fields to\nform the control, widget and route section offsets. Those le32 sizes\nare never checked against the fetched blob, so a module reporting a\nsmall topology size but large section sizes makes the offsets point\npast the allocation, and parsing reads out of bounds.\n\nReject a topology whose section sizes do not fit within the fetched\nsize before it is parsed."
          }
        ],
        "id": "CVE-2026-93280",
        "lastModified": "2026-09-24T16:17:25.290",
        "metrics": {},
        "published": "2026-09-24T16:17:25.290",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/33d8c7b794d2a30637c9d3fcb478f1d3222bef1e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/52daf9de692ebac813d110eb1e677dc0e1f4a5ab"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6f764363b3173d805be11e59a8f23ecee2d420d5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ba86de9f7b0d7903d2df5ea2373e34d8ca3fc43e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c9191f2e2f35f1209eb2dc24b31129dd47b48c16"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cfcc5a41a9664eb68023aae4cd0d485b256bd7c7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d0f6eaba60705bacd9bb4ce48eab50ef3f546777"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/dd5593aee0a0fb353e1164aff7b65e563fe1f232"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "suse_vex": {
      "aggregate_severity": "not set",
      "current_release_date": "2026-09-24T23:48:25Z",
      "cve": "CVE-2026-93280",
      "id": "CVE-2026-93280",
      "initial_release_date": "2026-09-24T23:48:25Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-93280",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-93280.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.