CVE-2026-72300

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the ASOC SOF topology parsing where the sof parse token sets() function reads the array->size field while iterating over topology private data. Because the loop condition only verifies that some data remains, a malformed topology with a truncated trailing vendor array can cause the parser to read the size field before a complete snd soc tplg vendor array header is available. Additionally, a type mismatch occurs when comparing the signed integer asize with the unsigned size t of sizeof(*array), which can allow negative values to pass the size check due to unsigned promotion.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.