CVE-2026-72300

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture (ASoC) Sound Open Firmware (SOF) topology component. The sof_parse_token_sets() function fails to properly validate the size of the vendor array when parsing topology private data. A local attacker could exploit this by providing malformed topology data, leading to an out-of-bounds read. This could result in system instability or a denial of service.

A moderate-severity out-of-bounds read flaw was found in the Linux kernel's ASoC Sound Open Firmware (SOF) topology parser. The sof_parse_token_sets() function reads the vendor array size field while iterating over topology private data without first validating that a complete snd_soc_tplg_vendor_array header is available, and its declared-size validation compares a signed size value against sizeof(), which promotes negative values to unsigned and lets them pass the check. A local attacker able to load a crafted, malformed SOF topology file could therefore trigger an out-of-bounds read in the kernel, resulting in system instability or a denial of service. Red Hat rated this flaw Moderate with a CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), reflecting a local attack vector with availability-only impact.

Within Red Hat's portfolio, the vulnerable code is present only in the kernel and kernel-rt components of Red Hat Enterprise Linux 9.9 and in the kernel component of Red Hat Enterprise Linux 10.3. The fix for these streams is currently deferred to a future update; given the moderate severity and the local, denial-of-service-only nature of this issue, the residual risk of the deferral is limited to local system crashes or driver initialization failures triggered by maliciously crafted topology data. All other Red Hat Enterprise Linux and Red Hat In-Vehicle OS streams tracked for this flaw were assessed as not affected because the vulnerable code is not present in them.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.