CVE-2026-93187
kernel: ASoC: SOF: ipc4-topology: Return error for invalid number of formats
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · September 17, 2026
Updated · October 14, 2026
Description
A flaw was found in the Linux kernel's Sound Open Firmware (SOF) IPC4 topology component. When internal functions sof_ipc4_widget_setup_comp_src() and sof_ipc4_widget_setup_comp_asrc() are invoked with an invalid number of input or output formats (specifically, zero), they incorrectly report a successful operation. This misreporting prevents the calling process from detecting the actual failure of the widget setup, potentially leading to unexpected system behavior or instability.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-393 · Return of Wrong Status Code