ASoC: SOF: topology: validate vendor array size before parsing
Summary
| CVE | CVE-2026-72300 |
|---|---|
| State | PUBLISHED |
| Assigner | Linux |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-08-15 06:22:02 UTC |
| Updated | 2026-08-17 06:18:32 UTC |
| Description | In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: topology: validate vendor array size before parsing sof_parse_token_sets() reads array->size while iterating over topology private data. The loop condition only checks that some data remains, so a malformed topology with a truncated trailing vendor array can make the parser read the size field before a full vendor-array header is available. Validate that the remaining private data contains a complete snd_soc_tplg_vendor_array header before reading array->size. The declared array size check also needs to remain signed. asize is an int, but sizeof(*array) has type size_t, so comparing them directly promotes negative asize values to unsigned and lets them pass the check, as reported in the stable review thread reference below. Cast sizeof(*array) to int when validating the declared array size. This rejects negative, zero and otherwise too-small sizes before the parser dispatches to the tuple-specific code. |
Risk And Classification
EPSS: 0.002000000 probability, percentile 0.101530000 (date 2026-08-17)
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Linux | Linux | affected 5c37bd025068381f5bdbbf6a5ae3a1da8f6ed928 7c6d2d2baeb1e62dc8c6951d27edc16c5ea6e3aa git | Not specified |
| CNA | Linux | Linux | affected 06d4938e41d62af7b5b3f39eb239f58b21f50443 a40e250414b463e953c54cd2a829c9a9a49a78c3 git | Not specified |
| CNA | Linux | Linux | affected 55024322915539098f7a7dd318351c7a003ff041 d34deef34c99bb4b3ebd2ac51058857827a20e7e git | Not specified |
| CNA | Linux | Linux | affected 215e5fe75881a7e2425df04aeeed47a903d5cd5d 201b60c4d15538fcc3c0c2ea9b75dd7d0f58022c git | Not specified |
| CNA | Linux | Linux | affected 215e5fe75881a7e2425df04aeeed47a903d5cd5d 8468dd79cfb2ffbdeaf7c353f63d64941cb8ba05 git | Not specified |
| CNA | Linux | Linux | affected 756c48bdf23050def518e85929be6edea9ae6823 git | Not specified |
| CNA | Linux | Linux | affected 6.6.136 6.6.145 semver | Not specified |
| CNA | Linux | Linux | affected 6.12.83 6.12.97 semver | Not specified |
| CNA | Linux | Linux | affected 6.18.24 6.18.40 semver | Not specified |
| CNA | Linux | Linux | affected 6.19.14 6.20 semver | Not specified |
| CNA | Linux | Linux | affected 7.0 | Not specified |
| CNA | Linux | Linux | unaffected 7.0 semver | Not specified |
| CNA | Linux | Linux | unaffected 6.6.145 6.6.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.12.97 6.12.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.18.40 6.18.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.1.5 7.1.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.2 * original_commit_for_fix | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| git.kernel.org/stable/c/8468dd79cfb2ffbdeaf7c353f63d64941cb8ba05 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/d34deef34c99bb4b3ebd2ac51058857827a20e7e | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/7c6d2d2baeb1e62dc8c6951d27edc16c5ea6e3aa | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/a40e250414b463e953c54cd2a829c9a9a49a78c3 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/201b60c4d15538fcc3c0c2ea9b75dd7d0f58022c | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.