CVE-2026-72263

The CVE-2026-72263 issue affects the Linux kernel ASoC: SOF topology loader. When a topology filename contains "dummy" and tplg_cnt is 0, snd_sof_load_topology returns -EINVAL without freeing the allocated tplg_files (kcalloc), causing a memory leak on such loads. The fixed behavior sets ret = -E...

CVE-2026-72263 ASoC: SOF: topology: fix memory leak in snd_sof_load_topology

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: topology: fix memory leak in sndsofloadtopology When the topology filename contains "dummy" and tplgcnt is 0, the function returns -EINVAL directly without freeing the tplgfiles allocated by kcalloc at line 2497. This...

CVE-2026-72262 ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Fix heap overflow in bytesext put/get The ipccontroldata buffer is allocated as kzallocmaxsize, where maxsize covers the entire struct sofipcctrldata including its flexible array payload. However, the...

CVE-2026-72261 ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Validate size in sndsofupdatecontrol In sndsofupdatecontrol, firmware-provided cdata-numelems is checked against localcdata-data-size but never against the actual allocation size. If localcdata-data-size...

EUVD-2026-59161

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Fix heap overflow in bytesext put/get The ipccontroldata buffer is allocated as kzallocmaxsize, where maxsize covers the entire struct sofipcctrldata including its flexible array payload. However, the...

EUVD-2026-59160

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Validate size in sndsofupdatecontrol In sndsofupdatecontrol, firmware-provided cdata-numelems is checked against localcdata-data-size but never against the actual allocation size. If localcdata-data-size...

CVE-2026-72261

Summary: CVE-2026-72261 affects the Linux kernel ASoC: SOF ipc3-control path. In snd_sof_update_control, the code validates firmware-provided cdata->num_elems against local_cdata->data->size but does not verify it against the actual allocation size. If local_cdata->data->size was p...

CVE-2026-72262

CVE-2026-72262 : In the Linux kernel ASoC SOF ipc3-control pathway, there is a heap overflow in bytes_ext_put/get due to incorrect bounds checks on the ipc_control_data buffer. The cdata->data payload sits after the struct and max_size was evaluated against the entire allocation, allowing writ...

CVE-2026-72262 ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Fix heap overflow in bytesext put/get The ipccontroldata buffer is allocated as kzallocmaxsize, where maxsize covers the entire struct sofipcctrldata including its flexible array payload. However, the...

PT-2026-72674

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the mtk-adsp mailbox component during device teardown. When the SOF audio driver fails to initialize, the snd sof dev object is freed. However, becau...

PT-2026-72449

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ASOC SOF ipc3-control component where the snd sof update control function fails to validate the firmware-provided cdata-num elems against the actual allocation siz...

PT-2026-72451

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the snd sof load topology function within the ASOC SOF topology component. When the topology filename contains the string "dummy" and the tplg cnt variable is 0,...

PT-2026-72450

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A heap overflow exists in the ASOC SOF ipc3-control component. The ipc control data buffer is allocated using kzallocmax size, but the bounds checks in the bytes ext put and bytes ext ge...

PT-2026-72490

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An integer overflow exists in the sof ipc3 control update function when calculating expected size using the firmware-provided cdata-num elems variable. On 32-bit platforms, this arithmet...

PT-2026-72488

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ASOC SOF topology parsing where the sof parse token sets function reads the array-size field while iterating over topology private data. Because the loop condition...

PT-2026-72491

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ASoC SOF ipc4-control component where the system fails to validate the MODULE NOTIFICATION payload length before reading bytes or channel data during control updat...

PT-2026-72492

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Time-of-Check to Time-of-Use TOCTOU issue exists in the sof ipc4 bytes put function. The copy size is derived from the existing data-size in the buffer instead of the size field of the...

PT-2026-72489

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Time-of-Check to Time-of-Use TOCTOU issue exists in the ASOC SOF ipc3-control component. In the sof ipc3 bytes put function, the memcpy operation uses a size derived from the existing...

CVE-2026-74332: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: acp-sdw-sof: Bound DAI link iteration createsdwdailinks walks sofdais until it finds an entry with initialised cleared, but sofdais is allocated with exactly numends entries. If all entries are initialised, the loop...

CVE-2026-72486: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: mailbox: mtk-adsp: fix UAF during device teardown When the SOF audio driver fails to initialize e.g. firmware boot timeout, its devres unwind frees the sndsofdev object that the mailbox client mtk-adsp-ipc reaches via...