CVE-2025-71286 ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls
Incorrect memory allocation size in Linux kernel ASoC SOF driver may lead to buffer overflow, allowing local attackers to execute code or escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-71286?
CVE-2025-71286 is a high-severity vulnerability in Linux kernel, published on 6 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls
The size of the data behind of scontrol->ipc_control_data for bytes controls is: [1] sizeof(struct sof_ipc4_control_data) + // kernel only struct [2] sizeof(struct sof_abi_hdr)) + payload
The max_size specifies the size of [2] and it is coming from topology.
Change the function to take this into account and allocate adequate amount of memory behind scontrol->ipc_control_data.
With the change we will allocate [1] amount more memory to be able to hold the full size of data.
Weakness: CWE-131
Which versions are affected by CVE-2025-71286?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-71286?
Apply the vendor's patch.
Is CVE-2025-71286 being exploited?
There is no known exploitation of CVE-2025-71286 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-71286, DEBIAN-CVE-2025-71286, GHSA-wjfp-2w53-2rcg, ROOT-OS-UBUNTU-2404-CVE-2025-71286, UBUNTU-CVE-2025-71286.