CVE-2026-72302

A flaw was found in the Linux kernel, specifically within the ASoC Sound Open Firmware (SOF) component. An integer overflow vulnerability exists in the sof_ipc3_control_update() function when calculating an expected size based on firmware-provided data on 32-bit systems. This flaw can lead to memory corruption, where the system attempts to write data beyond its allocated buffer. Such an issue could potentially allow a local attacker to gain elevated privileges or cause the system to crash, leading to a denial of service.

An integer overflow in the ASoC SOF IPC3 control update path can occur because the expected size is calculated from firmware provided cdata num_elems. On 32-bit platforms the calculation can wrap to a small value, allowing the size validation to pass with inconsistent control data and potentially causing out-of-bounds access in snd_sof_update_control. For the CVSS the PR:L is used in the paranoid score because a local user or local service with access to audio control paths may be able to influence the firmware control update flow without full administrator privileges, although the more typical reliable trigger requires firmware or topology control. The issue is not network reachable. Impact is at least local denial of service via kernel crash and in worst case may allow confidentiality or integrity impact due to memory corruption, so it should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.