Executive brief
The Sound Open Firmware (SOF) audio driver in the Linux kernel improperly validates topology configuration values used to allocate mixer volume tables. An attacker with the ability to supply a malformed audio topology file could trigger an integer overflow or out-of-bounds memory access, potentially leading to kernel crash or memory corruption. This affects systems using SOF-based audio interfaces with untrusted topology loading.
Technical details
The vulnerability exists in sound/soc/sof/topology.c within the sof_control_load_volume() function. The code treats mixer min and max values from topology files as indices into a volume table, storing them in signed integer fields and later allocating max+1 entries. However, it did not validate that min ≤ max or that max is below INT_MAX before using these values. An attacker can supply inverted ranges (min > max) or a max value ≥ INT_MAX, causing integer overflow during allocation or subsequent table indexing. The fix adds explicit validation: if (min > max || max >= INT_MAX) return -EINVAL, rejecting invalid topology configurations before they are processed. This prevents out-of-bounds allocation and memory corruption.
Affected products
- Linux Linux kernel Multiple versions (2.6.11.y through 7.1.y stable series)
Timeline
- 2026-09-17: disclosed
- 2026-09-14: patched: Commit 72d0b77412aef2cec554cc84e176658f2a48dafa backported to stable trees