soundwire: fix bug in sdw_add_element_group_count found by syzkaller
Summary
| CVE | CVE-2026-72488 |
|---|---|
| State | PUBLISHED |
| Assigner | Linux |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-08-15 06:22:23 UTC |
| Updated | 2026-10-21 13:19:38 UTC |
| Description | In the Linux kernel, the following vulnerability has been resolved: soundwire: fix bug in sdw_add_element_group_count found by syzkaller The original implementation caused an out-of-bounds memory access in the sdw_add_element_group_count for-loop when i == num. for (i = 0; i <= num; i++) { if (rate == group->rates[i] && lane == group->lanes[i]) ... To fix this error, the function now checks for existing rate/lane entries in the group(a function parameter) using a for-loop before adding them. No functional changes apart from this fix. |
Risk And Classification
Primary CVSS: v3.1 7.8 HIGH from 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.001730000 probability, percentile 0.063070000 (date 2026-10-16)
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | Secondary | 7.8 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | CNA | DECLARED | 7.8 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
CVSS v3.1 Breakdown
Attack Vector
LocalAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Linux | Linux | affected 9026118f20e28f202dab34f219bbb831ffb8c4dc a2275dce05e6d1cce69bf68f23ea7a63c0c54bae git | Not specified |
| CNA | Linux | Linux | affected 9026118f20e28f202dab34f219bbb831ffb8c4dc 5c3ce6d3559ce57e6c3108aa9ecf7b32764188c5 git | Not specified |
| CNA | Linux | Linux | affected 9026118f20e28f202dab34f219bbb831ffb8c4dc a454f61747c97e2eadaa7a35ffc1f4b1645c6a53 git | Not specified |
| CNA | Linux | Linux | affected 9026118f20e28f202dab34f219bbb831ffb8c4dc e483a406a23a92d5202e8d324f206e127eef48ff git | Not specified |
| CNA | Linux | Linux | affected 9026118f20e28f202dab34f219bbb831ffb8c4dc f772ff5a0e6758fd412803c09e03ba3bca5f5878 git | Not specified |
| CNA | Linux | Linux | affected 5.10 | Not specified |
| CNA | Linux | Linux | unaffected 5.10 semver | Not specified |
| CNA | Linux | Linux | unaffected 6.6.160 6.6.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.12.114 6.12.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.18.40 6.18.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.1.5 7.1.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.2 * original_commit_for_fix | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| git.kernel.org/stable/c/e483a406a23a92d5202e8d324f206e127eef48ff | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/5c3ce6d3559ce57e6c3108aa9ecf7b32764188c5 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/a454f61747c97e2eadaa7a35ffc1f4b1645c6a53 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/f772ff5a0e6758fd412803c09e03ba3bca5f5878 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/a2275dce05e6d1cce69bf68f23ea7a63c0c54bae | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.