CVE-2026-99182

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture When chcount is smaller than blob-alhcfg.devicecount e.g. a mono capture stream, such as a SmartMic, aggregated across multiple SDW links, step = chcoun...

CVE-2026-99182

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture When chcount is smaller than blob-alhcfg.devicecount e.g. a mono capture stream, such as a SmartMic, aggregated across multiple SDW links, step = chcoun...

EUVD-2026-111934

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture When chcount is smaller than blob-alhcfg.devicecount e.g. a mono capture stream, such as a SmartMic, aggregated across multiple SDW links, step = chcoun...

CVE-2026-99182

The Linux kernel contains a vulnerability in the ASoC: SOF: ipc4-topology component during aggregated ALH capture . When the number of channels (ch_count ) is smaller than the device count, the calculation for step truncates to 0, causing an underflow in GENMASK(step - 1, 0) . This results in a s...

CVE-2026-99182 ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture When chcount is smaller than blob-alhcfg.devicecount e.g. a mono capture stream, such as a SmartMic, aggregated across multiple SDW links, step = chcoun...

UBUNTU-CVE-2026-99182

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture When chcount is smaller than blob-alhcfg.devicecount e.g. a mono capture stream, such as a SmartMic, aggregated across multiple SDW links, step = chcoun...

PT-2026-128175

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture When ch count is smaller than blob-alh cfg.device count e.g. a mono capture stream, such as a SmartMic, aggregated across multiple SDW links, step = ch...

CVE-2026-99182

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture When chcount is smaller than blob-alhcfg.devicecount e.g. a mono capture stream, such as a SmartMic, aggregated across multiple SDW links, step = chcoun...

Linux sof_ipc4_bytes_put Heap Buffer Overflow

The vulnerability of the sofipc4bytesput function in the sound/soc/sof/ipc4-control.c component of the Linux operating system is related to the failure to release resources after their useful life has ended. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

Linux kernel Heap Buffer Overflow DoS

The vulnerability in the sofipc3controlupdate function within the sound/soc/sof/ipc3-control.c component of the Linux kernel system is related to improper calculation. Exploitation of this vulnerability may allow an attacker to compromise the confidentiality, integrity, and availability of...

Linux sof_parse_token_sets Heap Buffer Overflow DoS

The vulnerability of the sofparsetokensets function in the sound/soc/sof/topology.c component of the Linux operating system is related to insufficient resource control with dynamic management. Exploiting this vulnerability could allow an attacker to cause a service failure...

Linux create_sdw_dailinks Heap Buffer Overflow

The vulnerability of the createsdwdailinks function in the sound/soc/amd/acp/acp-sdw-sof-mach.c component of the Linux operating system is related to insufficient resource control during its existence. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

Astra Linux – vulnerability in linux-5.10

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: cnl: Do not process IPC reply before firmware boot It is not yet clear, but it is possible to create a firmware so broken that it will send a reply message before a FWREADY message it is not yet clear if FWREADY...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: hda-ipc: Do not process the IPC reply before the firmware boot. It is not yet clear, but it is possible to create a firmware that is so broken that it will send a reply message before a FWREADY message is receiv...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: sof-common: Added a NULL check for the normallink string. It is not guaranteed that all entries of struct sofconnstream declare a normallink a non-SOF, direct link string. This applies to SoCs that only support SO...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Use overflow checks in controlupdate size calc In sofipc3controlupdate, the expectedsize calculation uses cdata-numelems provided by the firmware in its arithmetic operations. This could lead to an overfl...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: ASoC: SOF: ipc3-control: Fixed a heap overflow in bytesext put/get The ipccontroldata buffer is allocated using kzallocmaxsize, where maxsize covers the entire struct sofipcctrldata, including its flexible array payload...

kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get

A flaw was found in the Advanced Linux Sound Architecture ALSA Sound Open Firmware SOF ipc3-control component of the Linux kernel. This vulnerability, a heap overflow, occurs due to incorrect bounds checks when handling user data lengths. An unprivileged local user can exploit this to write past...

kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get

A flaw was found in the Advanced Linux Sound Architecture ALSA Sound Open Firmware SOF ipc3-control component of the Linux kernel. This vulnerability, a heap overflow, occurs due to incorrect bounds checks when handling user data lengths. An unprivileged local user can exploit this to write past...

CVE-2026-93187

A flaw was found in the Linux kernel's Sound Open Firmware SOF IPC4 topology component. When internal functions sofipc4widgetsetupcompsrc and sofipc4widgetsetupcompasrc are invoked with an invalid number of input or output formats specifically, zero, they incorrectly report a successful operation...