CVE-2026-72262

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get

The ipc_control_data buffer is allocated as kzalloc(max_size), where

max_size covers the entire struct sof_ipc_ctrl_data including its

flexible array payload. However, the bounds checks in bytes_ext_put

and _bytes_ext_get compared user data lengths against max_size

directly, ignoring that cdata->data sits at an offset of

sizeof(struct sof_ipc_ctrl_data) bytes into the allocation.

This allowed writing up to sizeof(struct sof_ipc_ctrl_data) bytes past

the end of the heap buffer from unprivileged userspace via the ALSA TLV

kcontrol interface, and similarly allowed over-reading adjacent heap

data on the get path.

Fix all bounds checks to subtract sizeof(*cdata) from max_size so they

reflect the actual space available at the cdata->data offset. Also fix

the error-path restore in bytes_ext_put which wrote to cdata->data

instead of cdata, causing the same ove

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References