CVE-2026-72300: ASoC: SOF: topology: validate vendor array size before parsing

CVE-2026-72300: ASoC: SOF: topology: validate vendor array size before parsing

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ASoC: SOF: topology: validate vendor array size before parsing

sof_parse_token_sets() reads array->size while iterating over topology
private data. The loop condition only checks that some data remains, so a
malformed topology with a truncated trailing vendor array can make the
parser read the size field before a full vendor-array header is available.

Validate that the remaining private data contains a complete
snd_soc_tplg_vendor_array header before reading array->size.

The declared array size check also needs to remain signed. asize is an int,
but sizeof(*array) has type size_t, so comparing them directly promotes
negative asize values to unsigned and lets them pass the check,
as reported in the stable review thread reference below.

Cast sizeof(*array) to int when validating the declared array size. This
rejects negative, zero and otherwise too-small sizes before the parser
dispatches to the tuple-specific code.

The Linux kernel CVE team has assigned CVE-2026-72300 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.6.136 with commit 5c37bd025068381f5bdbbf6a5ae3a1da8f6ed928 and fixed in 6.6.145 with commit 7c6d2d2baeb1e62dc8c6951d27edc16c5ea6e3aa
	Issue introduced in 6.12.83 with commit 06d4938e41d62af7b5b3f39eb239f58b21f50443 and fixed in 6.12.97 with commit a40e250414b463e953c54cd2a829c9a9a49a78c3
	Issue introduced in 6.18.24 with commit 55024322915539098f7a7dd318351c7a003ff041 and fixed in 6.18.40 with commit d34deef34c99bb4b3ebd2ac51058857827a20e7e
	Issue introduced in 7.0 with commit 215e5fe75881a7e2425df04aeeed47a903d5cd5d and fixed in 7.1.5 with commit 201b60c4d15538fcc3c0c2ea9b75dd7d0f58022c
	Issue introduced in 7.0 with commit 215e5fe75881a7e2425df04aeeed47a903d5cd5d and fixed in 7.2-rc1 with commit 8468dd79cfb2ffbdeaf7c353f63d64941cb8ba05
	Issue introduced in 6.19.14 with commit 756c48bdf23050def518e85929be6edea9ae6823

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-72300
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	sound/soc/sof/topology.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/7c6d2d2baeb1e62dc8c6951d27edc16c5ea6e3aa
	https://git.kernel.org/stable/c/a40e250414b463e953c54cd2a829c9a9a49a78c3
	https://git.kernel.org/stable/c/d34deef34c99bb4b3ebd2ac51058857827a20e7e
	https://git.kernel.org/stable/c/201b60c4d15538fcc3c0c2ea9b75dd7d0f58022c
	https://git.kernel.org/stable/c/8468dd79cfb2ffbdeaf7c353f63d64941cb8ba05