CVE-2026-72301 (GCVE-0-2026-72301)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:55 – Updated: 2026-08-17 05:42
VLAI
Title
ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get
Summary
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get In sof_ipc3_bytes_put(), the size used for the memcpy is derived from the old data->size already in the buffer, not the incoming new data's size field. If the new data has a different size, the copy length is wrong: it may truncate valid data or copy stale bytes. Similarly, sof_ipc3_bytes_get() checks data->size against max_size without accounting for the sizeof(struct sof_ipc_ctrl_data) offset of the flex array within the allocation. Fix bytes_put to validate and use the incoming data's sof_abi_hdr.size from ucontrol before copying. Fix bytes_get to subtract sizeof(*cdata) from the bounds check to match the actual available space.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 544ac8858f249950b4d99c68e538cdc07300528f , < 8bd715a9d882fe1993bb2aec5eff89fffa946592 (git)
Affected: 544ac8858f249950b4d99c68e538cdc07300528f , < 0dce240145f47545d2e4b18c6d58033b83e1fd0e (git)
Affected: 544ac8858f249950b4d99c68e538cdc07300528f , < ed4f758f34be4c32e02933ac4fa044589d9c1c16 (git)
Affected: 544ac8858f249950b4d99c68e538cdc07300528f , < 0c4fbdaca225b97122b61b68c5353caa33a253c3 (git)
Affected: 544ac8858f249950b4d99c68e538cdc07300528f , < 92f90917413bdd6078fefff6f6c83a07bf870b04 (git)
Affected: 544ac8858f249950b4d99c68e538cdc07300528f , < 1f97760417b5faa60e9642fd0ed61eb17d0b1b39 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.18
Unaffected: 0 , < 5.18 (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/soc/sof/ipc3-control.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8bd715a9d882fe1993bb2aec5eff89fffa946592",
              "status": "affected",
              "version": "544ac8858f249950b4d99c68e538cdc07300528f",
              "versionType": "git"
            },
            {
              "lessThan": "0dce240145f47545d2e4b18c6d58033b83e1fd0e",
              "status": "affected",
              "version": "544ac8858f249950b4d99c68e538cdc07300528f",
              "versionType": "git"
            },
            {
              "lessThan": "ed4f758f34be4c32e02933ac4fa044589d9c1c16",
              "status": "affected",
              "version": "544ac8858f249950b4d99c68e538cdc07300528f",
              "versionType": "git"
            },
            {
              "lessThan": "0c4fbdaca225b97122b61b68c5353caa33a253c3",
              "status": "affected",
              "version": "544ac8858f249950b4d99c68e538cdc07300528f",
              "versionType": "git"
            },
            {
              "lessThan": "92f90917413bdd6078fefff6f6c83a07bf870b04",
              "status": "affected",
              "version": "544ac8858f249950b4d99c68e538cdc07300528f",
              "versionType": "git"
            },
            {
              "lessThan": "1f97760417b5faa60e9642fd0ed61eb17d0b1b39",
              "status": "affected",
              "version": "544ac8858f249950b4d99c68e538cdc07300528f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/soc/sof/ipc3-control.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get\n\nIn sof_ipc3_bytes_put(), the size used for the memcpy is derived from\nthe old data-\u003esize already in the buffer, not the incoming new data\u0027s\nsize field. If the new data has a different size, the copy length is\nwrong: it may truncate valid data or copy stale bytes.\n\nSimilarly, sof_ipc3_bytes_get() checks data-\u003esize against max_size\nwithout accounting for the sizeof(struct sof_ipc_ctrl_data) offset\nof the flex array within the allocation.\n\nFix bytes_put to validate and use the incoming data\u0027s sof_abi_hdr.size\nfrom ucontrol before copying. Fix bytes_get to subtract sizeof(*cdata)\nfrom the bounds check to match the actual available space."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local ALSA access via /dev/snd/controlC* and SNDRV_CTL_IOCTL_ELEM_READ/WRITE ioctls through snd_ctl_elem_write/read to sof_ipc3_bytes_put/get; SOF audio DSP controls are not reachable over the network.\nAC:L - An attacker can deterministically trigger the bug by sequencing bytes_put calls to set a large stale data-\u003esize then issue a second put with a smaller header, or use bytes_get after inflating size; no uncontrollable race or rare layout is required.\nPR:L - Only standard local access to the ALSA control device is needed; on typical Linux desktops and laptops with Intel/AMD SOF IPC3, session users in the audio group can write SOF bytes kcontrols without real root or init-namespace capabilities.\nUI:N - No victim interaction is required; a local attacker with sound-device access can directly issue ioctl-based ALSA control read/write operations against writable SOF bytes controls.\nS:U - The flaw corrupts kernel heap memory adjacent to a SOF control allocation and can enable local privilege escalation, but it does not cross a VM, IOMMU, or sandbox security boundary into another authority.\nC:H - sof_ipc3_bytes_get can memcpy up to roughly sizeof(struct sof_ipc_ctrl_data) bytes beyond the kzalloc(max_size) allocation into userspace when data-\u003esize passes an incorrect bound, leaking adjacent kernel heap contents.\nI:H - sof_ipc3_bytes_put uses stale data-\u003esize for memcpy length instead of the incoming sof_abi_hdr.size, enabling a heap out-of-bounds write past the control buffer that can corrupt adjacent kmalloc objects and be leveraged for code execution.\nA:H - The out-of-bounds read/write corrupts kernel heap metadata or adjacent objects and can cause kernel oops, panic, or hang when exploiting SOF IPC3 bytes controls on affected hardware."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:42:33.552Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8bd715a9d882fe1993bb2aec5eff89fffa946592"
        },
        {
          "url": "https://git.kernel.org/stable/c/0dce240145f47545d2e4b18c6d58033b83e1fd0e"
        },
        {
          "url": "https://git.kernel.org/stable/c/ed4f758f34be4c32e02933ac4fa044589d9c1c16"
        },
        {
          "url": "https://git.kernel.org/stable/c/0c4fbdaca225b97122b61b68c5353caa33a253c3"
        },
        {
          "url": "https://git.kernel.org/stable/c/92f90917413bdd6078fefff6f6c83a07bf870b04"
        },
        {
          "url": "https://git.kernel.org/stable/c/1f97760417b5faa60e9642fd0ed61eb17d0b1b39"
        }
      ],
      "title": "ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72301",
    "datePublished": "2026-08-15T05:55:20.430Z",
    "dateReserved": "2026-08-09T03:40:39.918Z",
    "dateUpdated": "2026-08-17T05:42:33.552Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72301",
      "date": "2026-09-20",
      "epss": "0.00164",
      "percentile": "0.06066"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "sound/soc/sof/ipc3-control.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "8bd715a9d882fe1993bb2aec5eff89fffa946592",
                    "status": "affected",
                    "version": "544ac8858f249950b4d99c68e538cdc07300528f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0dce240145f47545d2e4b18c6d58033b83e1fd0e",
                    "status": "affected",
                    "version": "544ac8858f249950b4d99c68e538cdc07300528f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ed4f758f34be4c32e02933ac4fa044589d9c1c16",
                    "status": "affected",
                    "version": "544ac8858f249950b4d99c68e538cdc07300528f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0c4fbdaca225b97122b61b68c5353caa33a253c3",
                    "status": "affected",
                    "version": "544ac8858f249950b4d99c68e538cdc07300528f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "92f90917413bdd6078fefff6f6c83a07bf870b04",
                    "status": "affected",
                    "version": "544ac8858f249950b4d99c68e538cdc07300528f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1f97760417b5faa60e9642fd0ed61eb17d0b1b39",
                    "status": "affected",
                    "version": "544ac8858f249950b4d99c68e538cdc07300528f",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "sound/soc/sof/ipc3-control.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.18"
                  },
                  {
                    "lessThan": "5.18",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get\n\nIn sof_ipc3_bytes_put(), the size used for the memcpy is derived from\nthe old data-\u003esize already in the buffer, not the incoming new data\u0027s\nsize field. If the new data has a different size, the copy length is\nwrong: it may truncate valid data or copy stale bytes.\n\nSimilarly, sof_ipc3_bytes_get() checks data-\u003esize against max_size\nwithout accounting for the sizeof(struct sof_ipc_ctrl_data) offset\nof the flex array within the allocation.\n\nFix bytes_put to validate and use the incoming data\u0027s sof_abi_hdr.size\nfrom ucontrol before copying. Fix bytes_get to subtract sizeof(*cdata)\nfrom the bounds check to match the actual available space."
          }
        ],
        "id": "CVE-2026-72301",
        "lastModified": "2026-08-17T06:18:33.097",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:22:02.807",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0c4fbdaca225b97122b61b68c5353caa33a253c3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0dce240145f47545d2e4b18c6d58033b83e1fd0e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1f97760417b5faa60e9642fd0ed61eb17d0b1b39"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8bd715a9d882fe1993bb2aec5eff89fffa946592"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/92f90917413bdd6078fefff6f6c83a07bf870b04"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ed4f758f34be4c32e02933ac4fa044589d9c1c16"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-18T20:57:29+00:00",
      "cve": "CVE-2026-72301",
      "id": "CVE-2026-72301",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72301.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-01T13:30:37Z",
      "cve": "CVE-2026-72301",
      "id": "CVE-2026-72301",
      "initial_release_date": "2026-09-01T13:30:37Z",
      "product_status:known_affected": "82",
      "product_status:known_not_affected": "280",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72301",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72301.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.