Junglewise Threat Intelligence

CVE-2025-71286: Linux Kernel ASoC SOF heap overflow in ipc4-topology

CVE-2025-71286 · Severity: high · CVSS 7.8 · Published 2026-05-06

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's audio subsystem (ASoC SOF) that could allow a local user to cause a system crash or potentially execute unauthorized code. The issue stems from an incorrect memory allocation size when handling certain audio control data, which can lead to a buffer overflow. This affects systems using the Sound Open Firmware (SOF) driver for audio processing.

Technical details

A heap-based buffer overflow vulnerability exists in sound/soc/sof/ipc4-topology.c within the Linux kernel. The function sof_ipc4_control_load_bytes incorrectly calculated the allocation size for scontrol->ipc_control_data by failing to account for the internal 'sof_ipc4_control_data' structure size in addition to the topology-provided max_size. A local attacker could exploit this insufficient allocation to trigger an out-of-bounds write. The issue has been resolved by ensuring the allocated memory accommodates both the kernel-internal structure and the maximum payload defined by the topology. Patches are available in stable kernel releases including 6.6.128, 6.12.75, 6.18.16, and 6.19.6.

Affected products

  • Linux Linux Kernel 6.4 to 6.6.127, 6.7 to 6.12.74, 6.13 to 6.18.15, 6.19 to 6.19.5

Timeline

  • 2025-12-17: disclosed: Initial patch submitted by Peter Ujfalusi
  • 2026-03-04: patched: Fix committed to stable kernel branches
  • 2026-05-06: advisory: CVE published to NVD

References

Related threats