From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 92D0136F911 for ; Sat, 15 Aug 2026 06:21:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786774874; cv=none; b=eVr2ctr3KYd8SPWXZ6cLjWRw03OVmY2R5BDCWjBIZgmb5KensJ3b9pE2yhtxWiFddaeXiBHfsp7kXsNqJJ6xa+CqyiCZOz7OlkXdk1rpPWoJmiY3w4abWBxCrMs6FEnpQVgW1VSOB1Esku+7yjEc4DI/ndZZFqZHgpwrbUf/pSw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786774874; c=relaxed/simple; bh=bwuwncLLstKOSi3mgc8RvWQQJfFS1WxAxN1lasTdpN8=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=DDqy8ht/XPXF0tJpLnQZBb4ulMsiHEo4nAH+yc7GiSO76tfg02ECu5UzZW22MiobDxA36ZHEmYoefWZrdE/aqbTZUtVVF7pFQEL9oZGleQwof/AhuQM5LLdt770EWT1Gd92MoOAkPJkcZp4Jye+dZKJCAsHeW7QV/+aKzfXcrxE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=hAVDxbmP; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="hAVDxbmP" Received: by smtp.kernel.org (Postfix) with ESMTPSA id E69B11F000E9; Sat, 15 Aug 2026 06:21:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1786774873; bh=+pi4gvZ68viE9JPXLlLfAE2R9zml+3mMBECzKPO2m+Q=; h=From:To:Cc:Subject:Date:Reply-To; b=hAVDxbmP38e24j5KTamkspmpzdEDiXM+Sxci2tSqL5lBcahaq6sBXEpynOmQ5mH6Q m15s60Ghl5iat2VAYfR+IS/WFt4kHEtHR2mr30lCnwi3O6nO1ztESG2NU5Wk1PFkcP Lk++KJ+gznxq2BVXWGcj5GupCNQ1vZWDfPy4oPKU= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-72300: ASoC: SOF: topology: validate vendor array size before parsing Date: Sat, 15 Aug 2026 15:06:19 +0900 Message-ID: <2026081502-CVE-2026-72300-ca4d@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3431; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=XuM4Mhdr//01f85hVJVxFp7224ZA4PoavevOcMLs9ak=; b=owGbwMvMwCRo6H6F97bub03G02pJDFkNDLcKpz2TrV771OR46u8QrtaD8vL7In6weNza/1/d5 kP7el+TjlgWBkEmBlkxRZYv23iO7q84pOhlaHsaZg4rE8gQBi5OAZjITy+GBUfF4sRC7uXwGZ4J 5HVJmzL5j/KRfwwLVqYWXLx1oeehd6OU6jv79TO9nnu5AwA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: topology: validate vendor array size before parsing sof_parse_token_sets() reads array->size while iterating over topology private data. The loop condition only checks that some data remains, so a malformed topology with a truncated trailing vendor array can make the parser read the size field before a full vendor-array header is available. Validate that the remaining private data contains a complete snd_soc_tplg_vendor_array header before reading array->size. The declared array size check also needs to remain signed. asize is an int, but sizeof(*array) has type size_t, so comparing them directly promotes negative asize values to unsigned and lets them pass the check, as reported in the stable review thread reference below. Cast sizeof(*array) to int when validating the declared array size. This rejects negative, zero and otherwise too-small sizes before the parser dispatches to the tuple-specific code. The Linux kernel CVE team has assigned CVE-2026-72300 to this issue. Affected and fixed versions =========================== Issue introduced in 6.6.136 with commit 5c37bd025068381f5bdbbf6a5ae3a1da8f6ed928 and fixed in 6.6.145 with commit 7c6d2d2baeb1e62dc8c6951d27edc16c5ea6e3aa Issue introduced in 6.12.83 with commit 06d4938e41d62af7b5b3f39eb239f58b21f50443 and fixed in 6.12.97 with commit a40e250414b463e953c54cd2a829c9a9a49a78c3 Issue introduced in 6.18.24 with commit 55024322915539098f7a7dd318351c7a003ff041 and fixed in 6.18.40 with commit d34deef34c99bb4b3ebd2ac51058857827a20e7e Issue introduced in 7.0 with commit 215e5fe75881a7e2425df04aeeed47a903d5cd5d and fixed in 7.1.5 with commit 201b60c4d15538fcc3c0c2ea9b75dd7d0f58022c Issue introduced in 7.0 with commit 215e5fe75881a7e2425df04aeeed47a903d5cd5d and fixed in 7.2-rc1 with commit 8468dd79cfb2ffbdeaf7c353f63d64941cb8ba05 Issue introduced in 6.19.14 with commit 756c48bdf23050def518e85929be6edea9ae6823 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-72300 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: sound/soc/sof/topology.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/7c6d2d2baeb1e62dc8c6951d27edc16c5ea6e3aa https://git.kernel.org/stable/c/a40e250414b463e953c54cd2a829c9a9a49a78c3 https://git.kernel.org/stable/c/d34deef34c99bb4b3ebd2ac51058857827a20e7e https://git.kernel.org/stable/c/201b60c4d15538fcc3c0c2ea9b75dd7d0f58022c https://git.kernel.org/stable/c/8468dd79cfb2ffbdeaf7c353f63d64941cb8ba05