CVE-2026-72261 (GCVE-0-2026-72261)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:54 – Updated: 2026-08-17 05:42
VLAI
Title
ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control
Summary
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control In snd_sof_update_control(), firmware-provided cdata->num_elems is checked against local_cdata->data->size but never against the actual allocation size. If local_cdata->data->size was previously set to an inconsistent value, the memcpy could write past the allocated buffer. Add a bounds check to ensure num_elems fits within the available space in the ipc_control_data allocation before copying.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
Linux CNA under the mitre root
CNA scorecard D 54/100 over 6618 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 10f461d79c2d1afb22344986cc1b4631169cf25e , < 1dc25a3e06364f48c4ef06016852f8b82425151a (git)
Affected: 10f461d79c2d1afb22344986cc1b4631169cf25e , < ee781058cd4d71e4449f41cbe6a3b8c59daa2c51 (git)
Affected: 10f461d79c2d1afb22344986cc1b4631169cf25e , < ecf67f1302f2080b4d241b973364aacda70ad740 (git)
Affected: 10f461d79c2d1afb22344986cc1b4631169cf25e , < d3abaedf6a58469610136d2dace1a85cddf7afcf (git)
Affected: 10f461d79c2d1afb22344986cc1b4631169cf25e , < 2a591bf6fd41fd14bdae689aafac4a9ee702c23c (git)
Affected: 10f461d79c2d1afb22344986cc1b4631169cf25e , < 390aa4c9339bb0ec0bc8d554e830faf93ca9d49e (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.18
Unaffected: 0 , < 5.18 (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/soc/sof/ipc3-control.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1dc25a3e06364f48c4ef06016852f8b82425151a",
              "status": "affected",
              "version": "10f461d79c2d1afb22344986cc1b4631169cf25e",
              "versionType": "git"
            },
            {
              "lessThan": "ee781058cd4d71e4449f41cbe6a3b8c59daa2c51",
              "status": "affected",
              "version": "10f461d79c2d1afb22344986cc1b4631169cf25e",
              "versionType": "git"
            },
            {
              "lessThan": "ecf67f1302f2080b4d241b973364aacda70ad740",
              "status": "affected",
              "version": "10f461d79c2d1afb22344986cc1b4631169cf25e",
              "versionType": "git"
            },
            {
              "lessThan": "d3abaedf6a58469610136d2dace1a85cddf7afcf",
              "status": "affected",
              "version": "10f461d79c2d1afb22344986cc1b4631169cf25e",
              "versionType": "git"
            },
            {
              "lessThan": "2a591bf6fd41fd14bdae689aafac4a9ee702c23c",
              "status": "affected",
              "version": "10f461d79c2d1afb22344986cc1b4631169cf25e",
              "versionType": "git"
            },
            {
              "lessThan": "390aa4c9339bb0ec0bc8d554e830faf93ca9d49e",
              "status": "affected",
              "version": "10f461d79c2d1afb22344986cc1b4631169cf25e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/soc/sof/ipc3-control.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: ipc3-control: Validate size in snd_sof_update_control\n\nIn snd_sof_update_control(), firmware-provided cdata-\u003enum_elems is\nchecked against local_cdata-\u003edata-\u003esize but never against the actual\nallocation size. If local_cdata-\u003edata-\u003esize was previously set to an\ninconsistent value, the memcpy could write past the allocated buffer.\n\nAdd a bounds check to ensure num_elems fits within the available space\nin the ipc_control_data allocation before copying."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached on local SOF/IPC3 systems when DSP firmware sends SOF_IPC_GLB_COMP_MSG notifications that flow through sof_ipc3_rx_msg() to sof_ipc3_control_update() and snd_sof_update_control(); setup uses local ALSA ioctl/TLV on /dev/snd/controlC*, not remote network input.\nAC:L - An attacker can create the inconsistent local_cdata-\u003edata-\u003esize via ALSA bytes put/get IPC to the DSP and then reliably provoke matching firmware control notifications by driving audio activity; no uncontrollable memory layout or victim timing is required.\nPR:L - Reaching SOF binary kcontrols requires only local ALSA access to sound control devices, which is typically granted to unprivileged users in the audio group without init-namespace root or CAP_SYS_ADMIN; user namespaces do not grant this hardware path.\nUI:N - No separate victim action is needed; exploitation uses the attacker\u0027s own local ALSA clients and audio sessions to reach the vulnerable IPC3 control-update path on affected SOF hardware.\nS:U - Impact is kernel heap corruption and privilege escalation within the host kernel security domain; it does not cross VM, container, or IOMMU boundaries into another authority.\nC:H - The unchecked memcpy can write past the ipc_control_data kzalloc buffer, corrupting adjacent kernel heap objects and enabling information disclosure or further memory corruption primitives beyond the intended control cache.\nI:H - This is an out-of-bounds kernel heap write that can overwrite adjacent structures and be leveraged for control-flow hijack or local privilege escalation, not merely limited or benign data modification.\nA:H - Writing beyond the allocated ipc_control_data buffer can corrupt critical kernel heap metadata or objects and cause kernel oops/panic or system instability, satisfying high availability impact for kernel crashes."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:42:10.529Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1dc25a3e06364f48c4ef06016852f8b82425151a"
        },
        {
          "url": "https://git.kernel.org/stable/c/ee781058cd4d71e4449f41cbe6a3b8c59daa2c51"
        },
        {
          "url": "https://git.kernel.org/stable/c/ecf67f1302f2080b4d241b973364aacda70ad740"
        },
        {
          "url": "https://git.kernel.org/stable/c/d3abaedf6a58469610136d2dace1a85cddf7afcf"
        },
        {
          "url": "https://git.kernel.org/stable/c/2a591bf6fd41fd14bdae689aafac4a9ee702c23c"
        },
        {
          "url": "https://git.kernel.org/stable/c/390aa4c9339bb0ec0bc8d554e830faf93ca9d49e"
        }
      ],
      "title": "ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72261",
    "datePublished": "2026-08-15T05:54:49.022Z",
    "dateReserved": "2026-08-09T03:40:39.915Z",
    "dateUpdated": "2026-08-17T05:42:10.529Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72261",
      "date": "2026-10-11",
      "epss": "0.00169",
      "percentile": "0.05671"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "sound/soc/sof/ipc3-control.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "1dc25a3e06364f48c4ef06016852f8b82425151a",
                    "status": "affected",
                    "version": "10f461d79c2d1afb22344986cc1b4631169cf25e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ee781058cd4d71e4449f41cbe6a3b8c59daa2c51",
                    "status": "affected",
                    "version": "10f461d79c2d1afb22344986cc1b4631169cf25e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ecf67f1302f2080b4d241b973364aacda70ad740",
                    "status": "affected",
                    "version": "10f461d79c2d1afb22344986cc1b4631169cf25e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d3abaedf6a58469610136d2dace1a85cddf7afcf",
                    "status": "affected",
                    "version": "10f461d79c2d1afb22344986cc1b4631169cf25e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2a591bf6fd41fd14bdae689aafac4a9ee702c23c",
                    "status": "affected",
                    "version": "10f461d79c2d1afb22344986cc1b4631169cf25e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "390aa4c9339bb0ec0bc8d554e830faf93ca9d49e",
                    "status": "affected",
                    "version": "10f461d79c2d1afb22344986cc1b4631169cf25e",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "sound/soc/sof/ipc3-control.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.18"
                  },
                  {
                    "lessThan": "5.18",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: ipc3-control: Validate size in snd_sof_update_control\n\nIn snd_sof_update_control(), firmware-provided cdata-\u003enum_elems is\nchecked against local_cdata-\u003edata-\u003esize but never against the actual\nallocation size. If local_cdata-\u003edata-\u003esize was previously set to an\ninconsistent value, the memcpy could write past the allocated buffer.\n\nAdd a bounds check to ensure num_elems fits within the available space\nin the ipc_control_data allocation before copying."
          }
        ],
        "id": "CVE-2026-72261",
        "lastModified": "2026-08-17T06:18:28.470",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:21:54.257",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1dc25a3e06364f48c4ef06016852f8b82425151a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2a591bf6fd41fd14bdae689aafac4a9ee702c23c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/390aa4c9339bb0ec0bc8d554e830faf93ca9d49e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d3abaedf6a58469610136d2dace1a85cddf7afcf"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ecf67f1302f2080b4d241b973364aacda70ad740"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ee781058cd4d71e4449f41cbe6a3b8c59daa2c51"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-24T09:40:44+00:00",
      "cve": "CVE-2026-72261",
      "id": "CVE-2026-72261",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:fixed": "453",
      "product_status:known_affected": "98",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72261.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T16:26:05Z",
      "cve": "CVE-2026-72261",
      "id": "CVE-2026-72261",
      "initial_release_date": "2026-08-31T16:26:05Z",
      "product_status:known_affected": "82",
      "product_status:known_not_affected": "280",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72261",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72261.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.