Executive brief
A vulnerability was identified in the Linux kernel's audio subsystem (ASoC SOF) that could allow a local user to cause a system crash or potentially execute unauthorized code. The issue stems from an incorrect memory allocation size when handling certain audio control data, which can lead to a buffer overflow. This affects systems using the Sound Open Firmware (SOF) driver for audio processing.
Technical details
A heap-based buffer overflow vulnerability exists in sound/soc/sof/ipc4-topology.c within the Linux kernel. The function sof_ipc4_control_load_bytes incorrectly calculated the allocation size for scontrol->ipc_control_data by failing to account for the internal 'sof_ipc4_control_data' structure size in addition to the topology-provided max_size. A local attacker could exploit this insufficient allocation to trigger an out-of-bounds write. The issue has been resolved by ensuring the allocated memory accommodates both the kernel-internal structure and the maximum payload defined by the topology. Patches are available in stable kernel releases including 6.6.128, 6.12.75, 6.18.16, and 6.19.6.
Affected products
- Linux Linux Kernel 6.4 to 6.6.127, 6.7 to 6.12.74, 6.13 to 6.18.15, 6.19 to 6.19.5
Timeline
- 2025-12-17: disclosed: Initial patch submitted by Peter Ujfalusi
- 2026-03-04: patched: Fix committed to stable kernel branches
- 2026-05-06: advisory: CVE published to NVD
References
- https://git.kernel.org/stable/c/1237cd9ff198cb882402572f29569e5247190974
- https://git.kernel.org/stable/c/491956b45b5f4933632ea6d8a8bdfdf045ab81e1
- https://git.kernel.org/stable/c/59fe643f21b9d59bcbedb0dfbf988ee455c23736
- https://git.kernel.org/stable/c/a653820700b81c9e6f05ac23b7969ecec1a18e85
- https://git.kernel.org/stable/c/a704a1a4394b5877b9adc31b2c3165ad0b541896