CVE-2026-72302

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An integer overflow exists in the sof ipc3 control update() function when calculating expected size using the firmware-provided cdata->num elems variable. On 32-bit platforms, this arithmetic can wrap to a small value, allowing the cdata->rhdr.hdr.size comparison to pass despite mismatched sizes. This condition can lead to out-of-bounds access within the snd sof update control() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.