Linux Kernel up to 7.2.5 ipc4-topology ipc4-topology.c input validation

Summaryinfo

A vulnerability classified as very critical has been found in Linux Kernel up to 7.2.5. This impacts the function sof_ipc4_widget_setup_comp_src/sof_ipc4_widget_setup_comp_asrc of the file ipc4-topology.c of the component ipc4-topology. The manipulation leads to input validation. This vulnerability is listed as CVE-2026-93187. The attack may be initiated remotely. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Linux Kernel up to 7.2.5 and classified as very critical. This issue affects the function sof_ipc4_widget_setup_comp_src/sof_ipc4_widget_setup_comp_asrc of the file ipc4-topology.c of the component ipc4-topology. The manipulation with an unknown input leads to a input validation vulnerability. Using CWE to declare the problem leads to CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Return error for invalid number of formats When the number of input or output formats is zero, sof_ipc4_widget_setup_comp_src() and sof_ipc4_widget_setup_comp_asrc() print an error and jump to the cleanup label. At that point 'ret' is still 0, because the earlier sof_ipc4_get_audio_fmt() call succeeded, so the function returns success and the caller never finds out that the widget setup actually failed. Set ret to -EINVAL before the goto so the error gets reported.

The advisory is shared at git.kernel.org. The identification of this vulnerability is CVE-2026-93187 since 09/17/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details are known, but no exploit is available. The price for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 09/18/2026).

Upgrading to version 7.2.6 or 7.3-rc1 eliminates this vulnerability. Applying the patch 4992cdc4eb97981d6ea66002c5b764a6115edb0c/11e828cd6b0f283ebe9dc6b4cffd38e3321e7725 is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.2.0
• 7.2.1
• 7.2.2
• 7.2.3
• 7.2.4
• 7.2.5

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion