UBUNTU-CVE-2026-72303

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-control: Validate notification payload size Validate MODULENOTIFICATION payload length before reading bytes/channel data in control update handling...

UBUNTU-CVE-2026-72415

In the Linux kernel, the following vulnerability has been resolved: ASoC: SDCA: Validate written enum value in geputenumdouble geputenumdouble passes the user-supplied enumeration index item0 to sndsocenumitemtoval without checking it against the number of items in the enum: ret =...

UBUNTU-CVE-2026-74291

In the Linux kernel, the following vulnerability has been resolved: ASoC: topology: Check PCM and DAI name strings before use Topology objects store several PCM and DAI names in fixed-size UAPI arrays. Other topology parser paths validate these fields with bounded strnlen checks before using them...

CVE-2026-74295

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: hdachdmi: Validate written enum value hdachdmisetpinportmux uses the written enum value to index the texts array before calling sndsocdapmputenumdouble, which validates that the value is within the enum item range. ...

UBUNTU-CVE-2026-74333

In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: acp-sdw-legacy: Bound DAI link iteration createsdwdailinks walks socdais until it finds an entry with initialised cleared, but socdais is allocated with exactly numends entries. If all entries are initialised, the loop...

UBUNTU-CVE-2026-74332

In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: acp-sdw-sof: Bound DAI link iteration createsdwdailinks walks sofdais until it finds an entry with initialised cleared, but sofdais is allocated with exactly numends entries. If all entries are initialised, the loop...

UBUNTU-CVE-2026-74292

In the Linux kernel, the following vulnerability has been resolved: ASoC: tegra: tegra210ahub: Validate written enum value tegraahubputvalueenum reads e-valuesitem0 before checking whether item0 is within the enum item range. The existing check therefore happens too late to prevent an out-of-rang...

UBUNTU-CVE-2026-72301

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Fix TOCTOU in bytesput and bytesget In sofipc3bytesput, the size used for the memcpy is derived from the old data-size already in the buffer, not the incoming new data's size field. If the new data has a...

UBUNTU-CVE-2026-72304

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-control: Fix TOCTOU in sofipc4bytesput In sofipc4bytesput, the copy size is derived from the old data-size in the buffer rather than the incoming new data's size field from ucontrol. If the new data has a differen...

UBUNTU-CVE-2026-72300

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: topology: validate vendor array size before parsing sofparsetokensets reads array-size while iterating over topology private data. The loop condition only checks that some data remains, so a malformed topology with a...

UBUNTU-CVE-2026-74294

In the Linux kernel, the following vulnerability has been resolved: ASoC: meson: aiu: Validate written enum values The AIU HDMI and internal codec mux put callbacks use the written enum value with sndsocenumitemtoval before checking whether the value is valid for the enumeration. Reject...

UBUNTU-CVE-2026-74295

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: hdachdmi: Validate written enum value hdachdmisetpinportmux uses the written enum value to index the texts array before calling sndsocdapmputenumdouble, which validates that the value is within the enum item range. ...

CVE-2026-72261

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Validate size in sndsofupdatecontrol In sndsofupdatecontrol, firmware-provided cdata-numelems is checked against localcdata-data-size but never against the actual allocation size. If localcdata-data-size...

CVE-2026-72262

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Fix heap overflow in bytesext put/get The ipccontroldata buffer is allocated as kzallocmaxsize, where maxsize covers the entire struct sofipcctrldata including its flexible array payload. However, the...

CVE-2026-72263

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: topology: fix memory leak in sndsofloadtopology When the topology filename contains "dummy" and tplgcnt is 0, the function returns -EINVAL directly without freeing the tplgfiles allocated by kcalloc at line 2497. This...

CVE-2026-72257

In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: q6apm: fix NULL pointer dereference in graphcallback When q6apmfreefragments is called it frees rxdata.buf/txdata.buf and sets them to NULL under graph-lock. A late DSP buffer-done response can race with this:...

CVE-2026-72258

In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8183: Release reserved memory on cleanup The MT8183 AFE probe can assign reserved memory with ofreservedmemdeviceinit, but the assignment is never released on driver removal or later probe failures. Register a...

CVE-2026-72259

In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8192: Release reserved memory on cleanup The MT8192 AFE probe calls ofreservedmemdeviceinit and falls back to preallocated buffers when no reserved memory region is available. When the reserved memory assignment...

UBUNTU-CVE-2026-72259

In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8192: Release reserved memory on cleanup The MT8192 AFE probe calls ofreservedmemdeviceinit and falls back to preallocated buffers when no reserved memory region is available. When the reserved memory assignment...

UBUNTU-CVE-2026-72261

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Validate size in sndsofupdatecontrol In sndsofupdatecontrol, firmware-provided cdata-numelems is checked against localcdata-data-size but never against the actual allocation size. If localcdata-data-size...