CVE-2026-72301

A flaw was found in the Linux kernel's Sound Open Firmware (SOF) IPC3 control module. This vulnerability, a Time-of-check to Time-of-use (TOCTOU) issue, arises from incorrect size handling during memory copy operations in the bytes_put and bytes_get functions. A local attacker could exploit this to cause data corruption, where valid data might be truncated or stale data copied, potentially resulting in information disclosure or denial of service.

This vulnerability is rated as Moderate because exploitation requires local access and is restricted to systems equipped with Sound Open Firmware (SOF) audio hardware. Default Red Hat Enterprise Linux server deployments do not actively use SOF DSP drivers or expose sound hardware interfaces to untrusted users, limiting overall exposure. Workstations or systems with supported audio hardware remain susceptible if local users have permission to interact with ALSA control devices.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.