CVE-2026-72261: ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control

CVE-2026-72261: ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control

In snd_sof_update_control(), firmware-provided cdata->num_elems is
checked against local_cdata->data->size but never against the actual
allocation size. If local_cdata->data->size was previously set to an
inconsistent value, the memcpy could write past the allocated buffer.

Add a bounds check to ensure num_elems fits within the available space
in the ipc_control_data allocation before copying.

The Linux kernel CVE team has assigned CVE-2026-72261 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.18 with commit 10f461d79c2d1afb22344986cc1b4631169cf25e and fixed in 6.1.178 with commit 1dc25a3e06364f48c4ef06016852f8b82425151a
	Issue introduced in 5.18 with commit 10f461d79c2d1afb22344986cc1b4631169cf25e and fixed in 6.6.145 with commit ee781058cd4d71e4449f41cbe6a3b8c59daa2c51
	Issue introduced in 5.18 with commit 10f461d79c2d1afb22344986cc1b4631169cf25e and fixed in 6.12.97 with commit ecf67f1302f2080b4d241b973364aacda70ad740
	Issue introduced in 5.18 with commit 10f461d79c2d1afb22344986cc1b4631169cf25e and fixed in 6.18.40 with commit d3abaedf6a58469610136d2dace1a85cddf7afcf
	Issue introduced in 5.18 with commit 10f461d79c2d1afb22344986cc1b4631169cf25e and fixed in 7.1.5 with commit 2a591bf6fd41fd14bdae689aafac4a9ee702c23c
	Issue introduced in 5.18 with commit 10f461d79c2d1afb22344986cc1b4631169cf25e and fixed in 7.2-rc1 with commit 390aa4c9339bb0ec0bc8d554e830faf93ca9d49e

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-72261
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	sound/soc/sof/ipc3-control.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/1dc25a3e06364f48c4ef06016852f8b82425151a
	https://git.kernel.org/stable/c/ee781058cd4d71e4449f41cbe6a3b8c59daa2c51
	https://git.kernel.org/stable/c/ecf67f1302f2080b4d241b973364aacda70ad740
	https://git.kernel.org/stable/c/d3abaedf6a58469610136d2dace1a85cddf7afcf
	https://git.kernel.org/stable/c/2a591bf6fd41fd14bdae689aafac4a9ee702c23c
	https://git.kernel.org/stable/c/390aa4c9339bb0ec0bc8d554e830faf93ca9d49e