CVE-2026-72304 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put
In sof_ipc4_bytes_put(), the copy size is derived from the old data->size in the buffer rather than the incoming new data's size field from ucontrol. If the new data has a different size, the copy uses the wrong length: it may truncate valid data or copy stale bytes.
Fix by validating and using the incoming data's sof_abi_hdr.size from ucontrol before copying.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability identified in the Linux kernel's SOF (Sound Open Firmware) subsystem represents a critical time-of-check to time-of-use flaw that affects the ipc4-control functionality within the sound driver framework. This issue resides in the sof_ipc4_bytes_put function where improper handling of data size validation creates opportunities for malicious actors to exploit inconsistencies between expected and actual data lengths during firmware communication processes. The flaw specifically impacts the interaction between userspace applications and the kernel's sound subsystem through the ALSA (Advanced Linux Sound Architecture) interface.
The technical implementation of this vulnerability stems from a fundamental mismatch in how data size is determined during the firmware control operation. When processing incoming control data through the sof_ipc4_bytes_put function, the system retrieves the copy size from the existing buffer's old data->size field rather than utilizing the new data's size information contained within the incoming ucontrol structure. This approach creates a race condition scenario where the system validates the old buffer state but then copies data based on potentially outdated size parameters. The vulnerability manifests when the new data contains a different size than the previous data, leading to either truncation of valid data or the copying of stale bytes that may contain sensitive information or corrupted data structures.
The operational impact of this vulnerability extends beyond simple data corruption scenarios and can potentially enable privilege escalation or denial-of-service conditions within the audio subsystem. Attackers could manipulate the size field in ucontrol structures to cause the system to copy incorrect amounts of data, potentially overwriting adjacent memory regions or reading from uninitialized buffers. This type of flaw aligns with CWE-367 Time-of-Check to Time-of-Use vulnerability classification and represents a significant concern for embedded systems and devices where audio firmware communication is critical. The issue affects systems using SOF-based sound drivers and can be exploited through malicious audio control operations that manipulate the size field in sof_abi_hdr structures.
The fix implementation addresses this vulnerability by enforcing proper validation of incoming data before any copying operations occur. The solution requires validating and utilizing the sof_abi_hdr.size field from the ucontrol structure rather than relying on potentially stale buffer information. This approach ensures that the copy operation uses the correct data length as specified by the incoming control message, eliminating the race condition that enabled the vulnerability. The mitigation strategy aligns with security best practices for preventing TOCTOU vulnerabilities and follows ATT&CK framework techniques related to privilege escalation through kernel-level memory corruption. The fix demonstrates proper input validation and parameter checking mechanisms that should be implemented in all firmware communication interfaces to prevent similar issues from occurring in other subsystems.
This vulnerability highlights the importance of careful memory management and parameter validation in kernel-level code, particularly within firmware interaction modules where timing-sensitive operations can create exploitable conditions. The resolution emphasizes the need for comprehensive testing of data flow paths in embedded systems and proper validation of all incoming control parameters before processing operations occur. Systems administrators should ensure that affected kernels are updated to versions containing this fix, as the vulnerability represents a potential vector for unauthorized access to audio subsystem resources and could be leveraged to gain elevated privileges within the operating system environment.