CVE-2026-72300 ASoC: SOF: topology: validate vendor array size before parsing
A missing size validation in the Linux kernel SOF topology parser allows out-of-bounds reads via malformed data, potentially causing crashes or information leaks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72300?
CVE-2026-72300 is a vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ASoC: SOF: topology: validate vendor array size before parsing
sof_parse_token_sets() reads array->size while iterating over topology private data. The loop condition only checks that some data remains, so a malformed topology with a truncated trailing vendor array can make the parser read the size field before a full vendor-array header is available.
Validate that the remaining private data contains a complete snd_soc_tplg_vendor_array header before reading array->size.
The declared array size check also needs to remain signed. asize is an int, but sizeof(*array) has type size_t, so comparing them directly promotes negative asize values to unsigned and lets them pass the check, as reported in the stable review thread reference below.
Cast sizeof(*array) to int when validating the declared array size. This rejects negative, zero and otherwise too-small sizes before the parser dispatches to the tuple-specific code.
Which versions are affected by CVE-2026-72300?
How do I fix CVE-2026-72300?
Apply the vendor's patch.
Is CVE-2026-72300 being exploited?
There is no known exploitation of CVE-2026-72300 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-72300, DEBIAN-CVE-2026-72300, GHSA-jvfh-wxw8-49hv, UBUNTU-CVE-2026-72300.