Linux kernel Heap Buffer Overflow DoS

The vulnerability in the sofipc3controlupdate function within the sound/soc/sof/ipc3-control.c component of the Linux kernel system is related to improper calculation. Exploitation of this vulnerability may allow an attacker to compromise the confidentiality, integrity, and availability of...

kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get

A flaw was found in the Advanced Linux Sound Architecture ALSA Sound Open Firmware SOF ipc3-control component of the Linux kernel. This vulnerability, a heap overflow, occurs due to incorrect bounds checks when handling user data lengths. An unprivileged local user can exploit this to write past...

kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get

A flaw was found in the Advanced Linux Sound Architecture ALSA Sound Open Firmware SOF ipc3-control component of the Linux kernel. This vulnerability, a heap overflow, occurs due to incorrect bounds checks when handling user data lengths. An unprivileged local user can exploit this to write past...

SUSE CVE-2026-72301

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Fix TOCTOU in bytesput and bytesget In sofipc3bytesput, the size used for the memcpy is derived from the old data-size already in the buffer, not the incoming new data's size field. If the new data has a...

CVE-2026-72301

A flaw was found in the Linux kernel's Sound Open Firmware SOF IPC3 control module. This vulnerability, a Time-of-check to Time-of-use TOCTOU issue, arises from incorrect size handling during memory copy operations in the bytesput and bytesget functions. A local attacker could exploit this to cau...

CVE-2026-72302

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Use overflow checks in controlupdate size calc In sofipc3controlupdate, the expectedsize calculation uses firmware-provided cdata-numelems in arithmetic that could overflow on 32-bit platforms, wrapping t...

CVE-2026-72301

Summary (CVE-2026-72301) The Linux kernel's ASoC: SOF ipc3-control component exposes a TOCTOU fix in sof_ipc3_bytes_put/bytes_get. The issue arises because memcpy length in sof_ipc3_bytes_put() used the old data->size from the buffer rather than the incoming data’s sof_abi_hdr.size, risking tr...

CVE-2026-72262 ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Fix heap overflow in bytesext put/get The ipccontroldata buffer is allocated as kzallocmaxsize, where maxsize covers the entire struct sofipcctrldata including its flexible array payload. However, the...

CVE-2026-72302: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Use overflow checks in controlupdate size calc In sofipc3controlupdate, the expectedsize calculation uses firmware-provided cdata-numelems in arithmetic that could overflow on 32-bit platforms, wrapping t...

CVE-2026-72301: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Fix TOCTOU in bytesput and bytesget In sofipc3bytesput, the size used for the memcpy is derived from the old data-size already in the buffer, not the incoming new data's size field. If the new data has a...

CVE-2026-72261: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Validate size in sndsofupdatecontrol In sndsofupdatecontrol, firmware-provided cdata-numelems is checked against localcdata-data-size but never against the actual allocation size. If localcdata-data-size...

sound-open-firmware:sof-ipc3: Crash in pthread_create

Detailed Report: https://oss-fuzz.com/testcase?key=4606084160749568 Project: sound-open-firmware Fuzzing Engine: libFuzzer Fuzz Target: sof-ipc3 Job Type: libfuzzerasani386sound-open-firmware Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x5b00df00 Crash State: pthreadcreate...

UBUNTU-CVE-2022-50115

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-topology: Prevent double freeing of ipccontroldata via loadbytes We have sanity checks for byte controls and if any of the fail the locally allocated scontrol-ipccontroldata is freed up, but not set to NULL. On a...

sound-open-firmware:sof-ipc3: Crash in pthread_create

Detailed Report: https://oss-fuzz.com/testcase?key=5904359311867904 Project: sound-open-firmware Fuzzing Engine: libFuzzer Fuzz Target: sof-ipc3 Job Type: libfuzzerasani386sound-open-firmware Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x00002fe6 Crash State: pthreadcreate...

sound-open-firmware:sof-ipc3: Crash in pthread_create

Detailed Report: https://oss-fuzz.com/testcase?key=6693063771422720 Project: sound-open-firmware Fuzzing Engine: libFuzzer Fuzz Target: sof-ipc3 Job Type: libfuzzerasani386sound-open-firmware Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x07020505 Crash State: pthreadcreate...

PT-2022-31080

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.18.3 Description A potential issue exists in the ASoC: SOF: ipc3-topology component, specifically with the get control data function when handling non-bytes payload. The actual impact and attack plausibility...