CVE-2026-72262

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A heap overflow exists in the ASOC SOF ipc3-control component. The ipc control data buffer is allocated using kzalloc(max size), but the bounds checks in the bytes ext put() and bytes ext get() functions compared user data lengths directly against max size. This failed to account for the offset of sizeof(struct sof ipc ctrl data) bytes where cdata->data begins. Consequently, unprivileged users could write past the end of the heap buffer or over-read adjacent heap data via the ALSA TLV kcontrol interface. Additionally, an error-path restore in bytes ext put() incorrectly wrote to cdata->data instead of cdata, leading to the same overflow.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.