CVE-2026-72300 (GCVE-0-2026-72300)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:55 – Updated: 2026-08-17 05:12
VLAI
Title
ASoC: SOF: topology: validate vendor array size before parsing
Summary
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: topology: validate vendor array size before parsing sof_parse_token_sets() reads array->size while iterating over topology private data. The loop condition only checks that some data remains, so a malformed topology with a truncated trailing vendor array can make the parser read the size field before a full vendor-array header is available. Validate that the remaining private data contains a complete snd_soc_tplg_vendor_array header before reading array->size. The declared array size check also needs to remain signed. asize is an int, but sizeof(*array) has type size_t, so comparing them directly promotes negative asize values to unsigned and lets them pass the check, as reported in the stable review thread reference below. Cast sizeof(*array) to int when validating the declared array size. This rejects negative, zero and otherwise too-small sizes before the parser dispatches to the tuple-specific code.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 5c37bd025068381f5bdbbf6a5ae3a1da8f6ed928 , < 7c6d2d2baeb1e62dc8c6951d27edc16c5ea6e3aa (git)
Affected: 06d4938e41d62af7b5b3f39eb239f58b21f50443 , < a40e250414b463e953c54cd2a829c9a9a49a78c3 (git)
Affected: 55024322915539098f7a7dd318351c7a003ff041 , < d34deef34c99bb4b3ebd2ac51058857827a20e7e (git)
Affected: 215e5fe75881a7e2425df04aeeed47a903d5cd5d , < 201b60c4d15538fcc3c0c2ea9b75dd7d0f58022c (git)
Affected: 215e5fe75881a7e2425df04aeeed47a903d5cd5d , < 8468dd79cfb2ffbdeaf7c353f63d64941cb8ba05 (git)
Affected: 756c48bdf23050def518e85929be6edea9ae6823 (git)
Affected: 6.6.136 , < 6.6.145 (semver)
Affected: 6.12.83 , < 6.12.97 (semver)
Affected: 6.18.24 , < 6.18.40 (semver)
Affected: 6.19.14 , < 6.20 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 7.0
Unaffected: 0 , < 7.0 (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/soc/sof/topology.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7c6d2d2baeb1e62dc8c6951d27edc16c5ea6e3aa",
              "status": "affected",
              "version": "5c37bd025068381f5bdbbf6a5ae3a1da8f6ed928",
              "versionType": "git"
            },
            {
              "lessThan": "a40e250414b463e953c54cd2a829c9a9a49a78c3",
              "status": "affected",
              "version": "06d4938e41d62af7b5b3f39eb239f58b21f50443",
              "versionType": "git"
            },
            {
              "lessThan": "d34deef34c99bb4b3ebd2ac51058857827a20e7e",
              "status": "affected",
              "version": "55024322915539098f7a7dd318351c7a003ff041",
              "versionType": "git"
            },
            {
              "lessThan": "201b60c4d15538fcc3c0c2ea9b75dd7d0f58022c",
              "status": "affected",
              "version": "215e5fe75881a7e2425df04aeeed47a903d5cd5d",
              "versionType": "git"
            },
            {
              "lessThan": "8468dd79cfb2ffbdeaf7c353f63d64941cb8ba05",
              "status": "affected",
              "version": "215e5fe75881a7e2425df04aeeed47a903d5cd5d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "756c48bdf23050def518e85929be6edea9ae6823",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.145",
              "status": "affected",
              "version": "6.6.136",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.97",
              "status": "affected",
              "version": "6.12.83",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18.40",
              "status": "affected",
              "version": "6.18.24",
              "versionType": "semver"
            },
            {
              "lessThan": "6.20",
              "status": "affected",
              "version": "6.19.14",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/soc/sof/topology.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.0"
            },
            {
              "lessThan": "7.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "6.6.136",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "6.12.83",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "6.18.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.19.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: topology: validate vendor array size before parsing\n\nsof_parse_token_sets() reads array-\u003esize while iterating over topology\nprivate data. The loop condition only checks that some data remains, so a\nmalformed topology with a truncated trailing vendor array can make the\nparser read the size field before a full vendor-array header is available.\n\nValidate that the remaining private data contains a complete\nsnd_soc_tplg_vendor_array header before reading array-\u003esize.\n\nThe declared array size check also needs to remain signed. asize is an int,\nbut sizeof(*array) has type size_t, so comparing them directly promotes\nnegative asize values to unsigned and lets them pass the check,\nas reported in the stable review thread reference below.\n\nCast sizeof(*array) to int when validating the declared array size. This\nrejects negative, zero and otherwise too-small sizes before the parser\ndispatches to the tuple-specific code."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:12:03.913Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7c6d2d2baeb1e62dc8c6951d27edc16c5ea6e3aa"
        },
        {
          "url": "https://git.kernel.org/stable/c/a40e250414b463e953c54cd2a829c9a9a49a78c3"
        },
        {
          "url": "https://git.kernel.org/stable/c/d34deef34c99bb4b3ebd2ac51058857827a20e7e"
        },
        {
          "url": "https://git.kernel.org/stable/c/201b60c4d15538fcc3c0c2ea9b75dd7d0f58022c"
        },
        {
          "url": "https://git.kernel.org/stable/c/8468dd79cfb2ffbdeaf7c353f63d64941cb8ba05"
        }
      ],
      "title": "ASoC: SOF: topology: validate vendor array size before parsing",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72300",
    "datePublished": "2026-08-15T05:55:19.786Z",
    "dateReserved": "2026-08-09T03:40:39.918Z",
    "dateUpdated": "2026-08-17T05:12:03.913Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72300",
      "date": "2026-09-21",
      "epss": "0.00206",
      "percentile": "0.10917"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "sound/soc/sof/topology.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "7c6d2d2baeb1e62dc8c6951d27edc16c5ea6e3aa",
                    "status": "affected",
                    "version": "5c37bd025068381f5bdbbf6a5ae3a1da8f6ed928",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a40e250414b463e953c54cd2a829c9a9a49a78c3",
                    "status": "affected",
                    "version": "06d4938e41d62af7b5b3f39eb239f58b21f50443",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d34deef34c99bb4b3ebd2ac51058857827a20e7e",
                    "status": "affected",
                    "version": "55024322915539098f7a7dd318351c7a003ff041",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "201b60c4d15538fcc3c0c2ea9b75dd7d0f58022c",
                    "status": "affected",
                    "version": "215e5fe75881a7e2425df04aeeed47a903d5cd5d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8468dd79cfb2ffbdeaf7c353f63d64941cb8ba05",
                    "status": "affected",
                    "version": "215e5fe75881a7e2425df04aeeed47a903d5cd5d",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "756c48bdf23050def518e85929be6edea9ae6823",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.6.145",
                    "status": "affected",
                    "version": "6.6.136",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.12.97",
                    "status": "affected",
                    "version": "6.12.83",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.18.40",
                    "status": "affected",
                    "version": "6.18.24",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.20",
                    "status": "affected",
                    "version": "6.19.14",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "sound/soc/sof/topology.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "7.0"
                  },
                  {
                    "lessThan": "7.0",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: topology: validate vendor array size before parsing\n\nsof_parse_token_sets() reads array-\u003esize while iterating over topology\nprivate data. The loop condition only checks that some data remains, so a\nmalformed topology with a truncated trailing vendor array can make the\nparser read the size field before a full vendor-array header is available.\n\nValidate that the remaining private data contains a complete\nsnd_soc_tplg_vendor_array header before reading array-\u003esize.\n\nThe declared array size check also needs to remain signed. asize is an int,\nbut sizeof(*array) has type size_t, so comparing them directly promotes\nnegative asize values to unsigned and lets them pass the check,\nas reported in the stable review thread reference below.\n\nCast sizeof(*array) to int when validating the declared array size. This\nrejects negative, zero and otherwise too-small sizes before the parser\ndispatches to the tuple-specific code."
          }
        ],
        "id": "CVE-2026-72300",
        "lastModified": "2026-08-17T06:18:32.993",
        "metrics": {},
        "published": "2026-08-15T06:22:02.690",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/201b60c4d15538fcc3c0c2ea9b75dd7d0f58022c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7c6d2d2baeb1e62dc8c6951d27edc16c5ea6e3aa"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8468dd79cfb2ffbdeaf7c353f63d64941cb8ba05"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a40e250414b463e953c54cd2a829c9a9a49a78c3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d34deef34c99bb4b3ebd2ac51058857827a20e7e"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-18T07:12:04+00:00",
      "cve": "CVE-2026-72300",
      "id": "CVE-2026-72300",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ASoC: SOF: topology: validate vendor array size before parsing",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72300.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-01T13:30:39Z",
      "cve": "CVE-2026-72300",
      "id": "CVE-2026-72300",
      "initial_release_date": "2026-09-01T13:30:39Z",
      "product_status:known_not_affected": "362",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72300",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72300.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.