GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-72262 (GCVE-0-2026-72262)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:54 – Updated: 2026-08-23 12:47
VLAI
Title
ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get
Summary
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get The ipc_control_data buffer is allocated as kzalloc(max_size), where max_size covers the entire struct sof_ipc_ctrl_data including its flexible array payload. However, the bounds checks in bytes_ext_put and _bytes_ext_get compared user data lengths against max_size directly, ignoring that cdata->data sits at an offset of sizeof(struct sof_ipc_ctrl_data) bytes into the allocation. This allowed writing up to sizeof(struct sof_ipc_ctrl_data) bytes past the end of the heap buffer from unprivileged userspace via the ALSA TLV kcontrol interface, and similarly allowed over-reading adjacent heap data on the get path. Fix all bounds checks to subtract sizeof(*cdata) from max_size so they reflect the actual space available at the cdata->data offset. Also fix the error-path restore in bytes_ext_put which wrote to cdata->data instead of cdata, causing the same overflow.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 67ec2a091630c28ea8d05db2bd7178a05b04b7e6 , < af4b437a463ac0482ba705434a44da06783778e6 (git)
Affected: 67ec2a091630c28ea8d05db2bd7178a05b04b7e6 , < 1adde1941bba7b0d7104b86ed819d48d81cb0ad9 (git)
Affected: 67ec2a091630c28ea8d05db2bd7178a05b04b7e6 , < eaa67e139c9217099e2a7b717aeeb46c65de3494 (git)
Affected: 67ec2a091630c28ea8d05db2bd7178a05b04b7e6 , < 121577383b5cf221e86581e0f2bcca4c66f17469 (git)
Affected: 67ec2a091630c28ea8d05db2bd7178a05b04b7e6 , < f4933e1d11b97b6a0951648b7c3e53850e1b33a9 (git)
Affected: 67ec2a091630c28ea8d05db2bd7178a05b04b7e6 , < fd46668d538993218eea19c6925c868ac0f2630c (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.18
Unaffected: 0 , < 5.18 (semver)
Unaffected: 6.1.184 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/soc/sof/ipc3-control.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "af4b437a463ac0482ba705434a44da06783778e6",
              "status": "affected",
              "version": "67ec2a091630c28ea8d05db2bd7178a05b04b7e6",
              "versionType": "git"
            },
            {
              "lessThan": "1adde1941bba7b0d7104b86ed819d48d81cb0ad9",
              "status": "affected",
              "version": "67ec2a091630c28ea8d05db2bd7178a05b04b7e6",
              "versionType": "git"
            },
            {
              "lessThan": "eaa67e139c9217099e2a7b717aeeb46c65de3494",
              "status": "affected",
              "version": "67ec2a091630c28ea8d05db2bd7178a05b04b7e6",
              "versionType": "git"
            },
            {
              "lessThan": "121577383b5cf221e86581e0f2bcca4c66f17469",
              "status": "affected",
              "version": "67ec2a091630c28ea8d05db2bd7178a05b04b7e6",
              "versionType": "git"
            },
            {
              "lessThan": "f4933e1d11b97b6a0951648b7c3e53850e1b33a9",
              "status": "affected",
              "version": "67ec2a091630c28ea8d05db2bd7178a05b04b7e6",
              "versionType": "git"
            },
            {
              "lessThan": "fd46668d538993218eea19c6925c868ac0f2630c",
              "status": "affected",
              "version": "67ec2a091630c28ea8d05db2bd7178a05b04b7e6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/soc/sof/ipc3-control.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get\n\nThe ipc_control_data buffer is allocated as kzalloc(max_size), where\nmax_size covers the entire struct sof_ipc_ctrl_data including its\nflexible array payload. However, the bounds checks in bytes_ext_put\nand _bytes_ext_get compared user data lengths against max_size\ndirectly, ignoring that cdata-\u003edata sits at an offset of\nsizeof(struct sof_ipc_ctrl_data) bytes into the allocation.\n\nThis allowed writing up to sizeof(struct sof_ipc_ctrl_data) bytes past\nthe end of the heap buffer from unprivileged userspace via the ALSA TLV\nkcontrol interface, and similarly allowed over-reading adjacent heap\ndata on the get path.\n\nFix all bounds checks to subtract sizeof(*cdata) from max_size so they\nreflect the actual space available at the cdata-\u003edata offset. Also fix\nthe error-path restore in bytes_ext_put which wrote to cdata-\u003edata\ninstead of cdata, causing the same overflow."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires a local ioctl on /dev/snd/controlC* (SNDRV_CTL_IOCTL_TLV_WRITE/READ) through the ALSA control device; there is no network, adjacent-radio, or physical-bus attack surface for this SOF IPC3 kcontrol path.\nAC:L - On affected SOF IPC3 systems with topology bytes_ext controls, an attacker can deterministically trigger the bug by issuing TLV writes with header.length equal to max_size, causing copy_from_user/memcpy to overrun the kzalloc(max_size) buffer by sizeof(struct sof_ipc_ctrl_data).\nPR:L - The fix commit states the overflow is reachable from unprivileged userspace via ALSA TLV kcontrols; any local user who can open the sound control device (typically membership in the audio group on Linux, or an app with audio access on Android/ChromeOS) can reach the vulnerable code without real root.\nUI:N - Exploitation is performed entirely by the attacker issuing ALSA TLV ioctls against an existing bytes_ext kcontrol; no victim click, mount, or other interactive action beyond the attacker\u0027s own access to the sound control interface is required.\nS:U - The vulnerability corrupts kernel heap memory from a local userspace context and enables standard kernel privilege escalation or denial of service; it does not cross a VM, container, or IOMMU security boundary into a separate authority.\nC:H - The get path can copy_to_user up to sizeof(struct sof_ipc_ctrl_data) bytes beyond the allocated ipc_control_data buffer, leaking adjacent kernel heap contents; combined with the controllable overflow, this is an out-of-bounds read/memory corruption primitive consistent with arbitrary disclosure potential.\nI:H - The put path performs an out-of-bounds heap write of up to sizeof(struct sof_ipc_ctrl_data) bytes past the kzalloc(max_size) allocation (including via the err_restore memcpy), enabling heap metadata/object corruption that can be developed into arbitrary kernel write or code execution.\nA:H - Heap out-of-bounds writes of roughly 96 bytes into adjacent slab objects can corrupt kernel structures and trigger oops/panic or wedged audio/subsystem state; repeated TLV operations make denial of service reliably achievable even without full exploitation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:47:11.302Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/af4b437a463ac0482ba705434a44da06783778e6"
        },
        {
          "url": "https://git.kernel.org/stable/c/1adde1941bba7b0d7104b86ed819d48d81cb0ad9"
        },
        {
          "url": "https://git.kernel.org/stable/c/eaa67e139c9217099e2a7b717aeeb46c65de3494"
        },
        {
          "url": "https://git.kernel.org/stable/c/121577383b5cf221e86581e0f2bcca4c66f17469"
        },
        {
          "url": "https://git.kernel.org/stable/c/f4933e1d11b97b6a0951648b7c3e53850e1b33a9"
        },
        {
          "url": "https://git.kernel.org/stable/c/fd46668d538993218eea19c6925c868ac0f2630c"
        }
      ],
      "title": "ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72262",
    "datePublished": "2026-08-15T05:54:49.635Z",
    "dateReserved": "2026-08-09T03:40:39.915Z",
    "dateUpdated": "2026-08-23T12:47:11.302Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72262",
      "date": "2026-09-15",
      "epss": "0.00182",
      "percentile": "0.08007"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-72262\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T06:21:54.443\",\"lastModified\":\"2026-08-23T13:16:42.910\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get\\n\\nThe ipc_control_data buffer is allocated as kzalloc(max_size), where\\nmax_size covers the entire struct sof_ipc_ctrl_data including its\\nflexible array payload. However, the bounds checks in bytes_ext_put\\nand _bytes_ext_get compared user data lengths against max_size\\ndirectly, ignoring that cdata-\u003edata sits at an offset of\\nsizeof(struct sof_ipc_ctrl_data) bytes into the allocation.\\n\\nThis allowed writing up to sizeof(struct sof_ipc_ctrl_data) bytes past\\nthe end of the heap buffer from unprivileged userspace via the ALSA TLV\\nkcontrol interface, and similarly allowed over-reading adjacent heap\\ndata on the get path.\\n\\nFix all bounds checks to subtract sizeof(*cdata) from max_size so they\\nreflect the actual space available at the cdata-\u003edata offset. Also fix\\nthe error-path restore in bytes_ext_put which wrote to cdata-\u003edata\\ninstead of cdata, causing the same overflow.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"sound/soc/sof/ipc3-control.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"67ec2a091630c28ea8d05db2bd7178a05b04b7e6\",\"lessThan\":\"af4b437a463ac0482ba705434a44da06783778e6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"67ec2a091630c28ea8d05db2bd7178a05b04b7e6\",\"lessThan\":\"1adde1941bba7b0d7104b86ed819d48d81cb0ad9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"67ec2a091630c28ea8d05db2bd7178a05b04b7e6\",\"lessThan\":\"eaa67e139c9217099e2a7b717aeeb46c65de3494\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"67ec2a091630c28ea8d05db2bd7178a05b04b7e6\",\"lessThan\":\"121577383b5cf221e86581e0f2bcca4c66f17469\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"67ec2a091630c28ea8d05db2bd7178a05b04b7e6\",\"lessThan\":\"f4933e1d11b97b6a0951648b7c3e53850e1b33a9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"67ec2a091630c28ea8d05db2bd7178a05b04b7e6\",\"lessThan\":\"fd46668d538993218eea19c6925c868ac0f2630c\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"sound/soc/sof/ipc3-control.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.184\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.145\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.97\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.40\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/121577383b5cf221e86581e0f2bcca4c66f17469\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/1adde1941bba7b0d7104b86ed819d48d81cb0ad9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/af4b437a463ac0482ba705434a44da06783778e6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/eaa67e139c9217099e2a7b717aeeb46c65de3494\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f4933e1d11b97b6a0951648b7c3e53850e1b33a9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fd46668d538993218eea19c6925c868ac0f2630c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-19T05:26:07+00:00",
      "cve": "CVE-2026-72262",
      "id": "CVE-2026-72262",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72262.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-15T01:27:36Z",
      "cve": "CVE-2026-72262",
      "id": "CVE-2026-72262",
      "initial_release_date": "2026-08-31T16:26:03Z",
      "product_status:first_fixed": "96",
      "product_status:known_affected": "467",
      "product_status:known_not_affected": "268",
      "product_status:recommended": "42",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72262",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72262.json",
      "version": "8"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.