CVE-2026-90196

A flaw was found in the Linux kernel's Sound Open Firmware (SOF) component. This vulnerability occurs due to improper validation of topology mixer volume ranges. An attacker could potentially provide malformed volume range values, leading to an integer overflow during memory allocation. This could result in a denial of service (DoS) condition or memory corruption.

A flaw was found in the Linux kernel's Sound Open Firmware (SOF) driver, which Red Hat Product Security has rated as having Moderate impact (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). The SOF driver fails to validate audio topology mixer volume ranges before storing them and allocating its volume table: it treats the topology mixer min and max values as non-negative indices into the volume table, stores them in signed fields, allocates max + 1 entries through an int argument, and later indexes the table with the stored range. A local attacker able to load a crafted audio topology containing malformed volume range values (an inverted range or a maximum at or above INT_MAX) could trigger an integer overflow during the allocation, leading to out-of-bounds access and memory corruption or a system crash (denial of service). While the underlying integer overflow could theoretically cause memory corruption, Red Hat's CVSS assessment reflects an availability-only impact.

Red Hat Enterprise Linux 8, 9, and 10 (kernel and kernel-rt), Red Hat In-Vehicle OS 2, and the RHEL CoreOS kernels shipped in OpenShift Container Platform 4 are affected. Red Hat Enterprise Linux 6 and 7 Extended Life Cycle Support streams are not affected because the vulnerable code is not present in those kernel versions.

A fix is currently deferred for the affected products. Exploitation requires local access and the ability to supply a malformed audio topology to the SOF subsystem, and the practical impact is limited to system availability; the residual risk of deferring the fix is therefore considered low, and the fix will be addressed in a future update rather than through an immediate backport.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.