CVE-2026-72302
Description
A flaw was found in the Linux kernel, specifically within the ASoC Sound Open Firmware (SOF) component. An integer overflow vulnerability exists in the sof_ipc3_control_update() function when calculating an expected size based on firmware-provided data on 32-bit systems. This flaw can lead to memory corruption, where the system attempts to write data beyond its allocated buffer. Such an issue could potentially allow a local attacker to gain elevated privileges or cause the system to crash, leading to a denial of service.
Statement
An integer overflow in the ASoC SOF IPC3 control update path can occur because the expected size is calculated from firmware provided cdata num_elems. On 32-bit platforms the calculation can wrap to a small value, allowing the size validation to pass with inconsistent control data and potentially causing out-of-bounds access in snd_sof_update_control. For the CVSS the PR:L is used in the paranoid score because a local user or local service with access to audio control paths may be able to influence the firmware control update flow without full administrator privileges, although the more typical reliable trigger requires firmware or topology control. The issue is not network reachable. Impact is at least local denial of service via kernel crash and in worst case may allow confidentiality or integrity impact due to memory corruption, so it should be reviewed manually.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | 7.8 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | High |
| Integrity Impact | None | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
