CVE-2026-93280 in Linux
Summary
by MITRE • 09/24/2026
In the Linux kernel, the following vulnerability has been resolved:
greybus: audio: bound the topology section sizes against the fetched size
gb_audio_gb_get_topology() fetches a topology blob of a module-supplied size, and gbaudio_tplg_parse_data() then walks it by adding the module-supplied size_dais, size_controls and size_widgets fields to form the control, widget and route section offsets. Those le32 sizes are never checked against the fetched blob, so a module reporting a small topology size but large section sizes makes the offsets point past the allocation, and parsing reads out of bounds.
Reject a topology whose section sizes do not fit within the fetched size before it is parsed.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/24/2026
The Linux kernel vulnerability identified in the greybus audio subsystem represents a critical input validation failure that allows for out-of-bounds memory access through malformed module-supplied data. The core of this issue resides in the gb_audio_gb_get_topology function, which retrieves an audio topology blob from a connected hardware module. This blob contains metadata describing the structure of the audio pipeline, including specific fields such as size_dais, size_controls, and size_widgets. These fields are used by gbaudio_tplg_parse_data to calculate offsets for various sections within the data structure. The fundamental flaw is that these le32 values provided by the module are accepted without any verification against the actual total size of the fetched blob. This lack of boundary checking creates a scenario where a malicious or buggy hardware module can report a small overall topology size while simultaneously specifying large section sizes for its internal components.
When the parser processes this malformed data, it calculates offsets that exceed the allocated memory buffer containing the topology blob. As the parsing routine attempts to read these sections using the calculated offsets, it accesses memory locations outside the bounds of the original allocation. This constitutes an out-of-bounds read vulnerability, which falls under CWE-125: Out-of-bounds Read in standard classification systems. The operational impact of this flaw is significant because reading beyond allocated buffers can lead to information disclosure, where sensitive kernel data or other process memory contents are leaked to the user space or logged by the system. In more severe scenarios involving subsequent processing of these invalid pointers, such as dereferencing them for further operations, the vulnerability could potentially be leveraged to cause a denial of service through a kernel panic or even facilitate arbitrary code execution if the attacker can control the data read and manipulate memory state accordingly.
This type of vulnerability is often associated with CWE-20: Improper Input Validation, as the system fails to adequately verify that the input conforms to expected structural constraints before processing it. From an offensive security perspective, this flaw aligns with ATT&CK technique T1567.002: Exfiltration Over Unencrypted Non-C2 Protocol if used for data exfiltration, or generally falls under initial exploitation vectors involving memory corruption due to improper boundary checks. The greybus interface serves as a bridge between the host processor and peripheral modules, making it an attractive attack surface for physical access adversaries who can manipulate connected hardware components to inject malicious topology definitions.
To mitigate this vulnerability, developers must implement strict validation logic within the gb_audio_gb_get_topology function before any parsing operations commence. Specifically, the sum of size_dais, size_controls, and size_widgets should be validated against the total fetched blob size to ensure that all section offsets remain within valid memory boundaries. Additionally, each individual section size should be checked to prevent overflow conditions during offset calculation. System administrators can reduce risk by ensuring their greybus-enabled devices are updated with patched kernel versions that enforce these bounds checks. Regular security audits of hardware interface drivers and the implementation of fuzzing tests targeting topology blob structures can further help identify similar validation gaps in other subsystems, thereby hardening the overall system against malformed input attacks.