CVE-2026-72303

A flaw was found in the ASoC Sound Open Firmware (SOF) ipc4-control component of the Linux kernel. This vulnerability arises from insufficient validation of the MODULE_NOTIFICATION payload length when handling control updates. An attacker could potentially exploit this by providing a malformed notification, which may lead to unexpected system behavior or a denial of service.

A moderate out-of-bounds read vulnerability was found in the Linux kernel ASoC Sound Open Firmware (SOF) IPC4 control update handling. The MODULE_NOTIFICATION payload length is not validated before bytes/channel control data is read, so a malformed notification reaching the SOF IPC4 audio control path can cause the kernel to read past the end of the notification buffer, resulting in a kernel crash and local denial of service. Red Hat rated this flaw Moderate (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploitation requires local access on a system with affected SOF IPC4 audio support and the impact is limited to availability; this differs from the upstream CVEORG score of 7.8, which assumes high confidentiality and integrity impact that the evidence for this read-only flaw does not support. The vulnerable code, introduced through the SOF ipc4-control generic bytes control support, is present only in Red Hat Enterprise Linux 9 and Red Hat Enterprise Linux 10 kernel streams currently under development (kernel-rt is affected on RHEL 9 as well); earlier RHEL releases and maintenance streams (RHEL 6, 7, 8, the RHEL 9.x and 10.0/10.2 update streams, and Red Hat In-Vehicle OS) do not contain the vulnerable code and are therefore not affected. Fixes for the affected streams are deferred to a future update; the residual risk until a fix ships is local denial of service on systems using affected SOF IPC4 audio hardware.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.