CVE-2026-72262

A flaw was found in the Advanced Linux Sound Architecture (ALSA) Sound Open Firmware (SOF) ipc3-control component of the Linux kernel. This vulnerability, a heap overflow, occurs due to incorrect bounds checks when handling user data lengths. An unprivileged local user can exploit this to write past allocated memory or read adjacent heap data, potentially leading to information disclosure or arbitrary code execution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, prevent the Sound Open Firmware kernel module from loading by blacklisting it in the modprobe configuration:

1. Create a configuration file to blacklist and disable autoloading of the module:

echo "blacklist snd-sof" >> /etc/modprobe.d/snd-sof.conf

echo "install snd-sof /bin/true" >> /etc/modprobe.d/snd-sof.conf

2. If the module is already loaded, a system reboot is required for the configuration to take effect:

reboot

Caveats: Applying this workaround will disable audio functionality on hardware platforms that depend on the Sound Open Firmware (SOF) driver subsystem.