CVE-2026-90196

A flaw was found in the Linux kernel's Sound Open Firmware (SOF) driver, which Red Hat Product Security has rated as having Moderate impact (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). The SOF driver fails to validate audio topology mixer volume ranges before storing them and allocating its volume table: it treats the topology mixer min and max values as non-negative indices into the volume table, stores them in signed fields, allocates max + 1 entries through an int argument, and later indexes the table with the stored range. A local attacker able to load a crafted audio topology containing malformed volume range values (an inverted range or a maximum at or above INT_MAX) could trigger an integer overflow during the allocation, leading to out-of-bounds access and memory corruption or a system crash (denial of service). While the underlying integer overflow could theoretically cause memory corruption, Red Hat's CVSS assessment reflects an availability-only impact.

Red Hat Enterprise Linux 8, 9, and 10 (kernel and kernel-rt), Red Hat In-Vehicle OS 2, and the RHEL CoreOS kernels shipped in OpenShift Container Platform 4 are affected. Red Hat Enterprise Linux 6 and 7 Extended Life Cycle Support streams are not affected because the vulnerable code is not present in those kernel versions.

A fix is currently deferred for the affected products. Exploitation requires local access and the ability to supply a malformed audio topology to the SOF subsystem, and the practical impact is limited to system availability; the residual risk of deferring the fix is therefore considered low, and the fix will be addressed in a future update rather than through an immediate backport.