CVE-2026-72302 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc
In sof_ipc3_control_update(), the expected_size calculation uses firmware-provided cdata->num_elems in arithmetic that could overflow on 32-bit platforms, wrapping to a small value. This would allow the cdata->rhdr.hdr.size comparison to pass with mismatched sizes, potentially leading to out-of-bounds access in snd_sof_update_control.
Use check_mul_overflow() and check_add_overflow() to detect and reject overflowed size calculations.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability resides within the Linux kernel's sound subsystem specifically in the SOF (Sound Open Firmware) component that handles IPC3 (Inter-Process Communication version 3) control operations. This issue affects the sof_ipc3_control_update() function which processes control update messages from firmware components. The flaw demonstrates a classic integer overflow condition that can occur on 32-bit platforms where arithmetic operations involving firmware-provided data elements may wrap around to produce unexpectedly small values.
The technical implementation involves the calculation of expected_size using cdata->num_elems as a multiplier or addend in arithmetic operations without proper overflow validation. When firmware sends control update messages containing large values for num_elems, the multiplication or addition operations can exceed the maximum representable value for 32-bit integers, causing the result to wrap around to a small positive integer or zero. This overflowed calculation then fails to properly validate against the actual message size contained in cdata->rhdr.hdr.size, creating a scenario where mismatched sizes appear to be valid.
The operational impact of this vulnerability extends beyond simple memory corruption as it creates potential for out-of-bounds access within the snd_sof_update_control function. This could enable malicious firmware components or attackers with firmware modification capabilities to execute arbitrary code or cause system instability. The vulnerability represents a serious security concern because it allows an attacker to manipulate control update operations in a way that bypasses normal size validation checks, potentially leading to privilege escalation or denial of service conditions.
The mitigation strategy involves implementing proper overflow detection using kernel-provided functions check_mul_overflow() and check_add_overflow() which are specifically designed to detect arithmetic overflows before they occur. These functions integrate with the kernel's existing security frameworks and provide a robust mechanism for preventing integer overflows in critical code paths. The fix aligns with common vulnerability prevention practices outlined in CWE-190 (Integer Overflow or Wraparound) and follows security best practices from the ATT&CK framework's privilege escalation techniques. This approach ensures that firmware-provided values are validated before use in arithmetic operations, making the system resilient against maliciously crafted control update messages. The solution maintains backward compatibility while strengthening the kernel's defenses against integer overflow attacks that could compromise system integrity.