PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-72301 Linux CVE debrief

A use-after-free vulnerability was discovered in the Linux kernel's ASoC (Advanced System on Chip) SOF (Sound Open Firmware) ipc3-control module. The vulnerability arises from a timing issue (TOCTOU, or Time-of-Check-to-Time-of-Use) in the `bytes_put` and `bytes_get` functions. In `sof_ipc3_bytes_put()`, the size used for the memcpy operation is derived from the old `data->size` already in the buffer, rather than the size of the incoming new data. This can lead to incorrect copy lengths, potentially truncating valid data or copying stale bytes. In `sof_ipc3_bytes_get()`, the function checks `data->size` against `max_size` without accounting for the offset of the flex array within the allocation, which can also lead to incorrect handling of data. The issue has been resolved by validating and using the incoming data's `sof_abi_hdr.size` in `bytes_put`, and by subtracting the size of `struct sof_ipc_ctrl_data` from the bounds check in `bytes_get` to match the actual available space.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-15
Original CVE updated
2026-08-15
Advisory published
2026-08-15
Advisory updated
2026-08-15

Who should care

Linux kernel developers, Linux distribution maintainers, and users of Linux-based systems should be aware of this vulnerability and take steps to mitigate it. Additionally, organizations that use Linux-based systems in their infrastructure should also be aware of this vulnerability and take steps to protect their systems.

Technical summary

The vulnerability is caused by a TOCTOU issue in the `bytes_put` and `bytes_get` functions of the ASoC SOF ipc3-control module in the Linux kernel. The `bytes_put` function uses the old `data->size` to determine the copy length, rather than the size of the incoming new data. The `bytes_get` function checks `data->size` against `max_size` without accounting for the offset of the flex array within the allocation. This can lead to incorrect handling of data, potentially allowing for privilege escalation and control of affected systems.

Defensive priority

This vulnerability has a high defensive priority due to its potential impact on system stability and security. Linux kernel vulnerabilities can be particularly dangerous as they can allow for privilege escalation and control of affected systems.

Recommended defensive actions

  • Review and apply the provided patches to the Linux kernel to fix the vulnerability
  • Ensure that the Linux kernel is updated to a version that includes the fix
  • Monitor system logs for potential exploitation attempts
  • Implement additional security controls, such as SELinux or AppArmor, to limit the impact of a potential exploit
  • Perform a thorough review of system configurations to ensure that they align with security best practices
  • Verify that all necessary security updates are applied and that the system is running with the latest security patches
  • Track and document changes to the system and its configurations to ensure accountability and facilitate future audits

Evidence notes

The evidence for this vulnerability is based on the official CVE record and the NVD detail page. The CVE record provides a brief description of the vulnerability, while the NVD detail page offers additional information on the vulnerability's impact and potential mitigations. However, due to limited information available, further verification and validation are necessary to fully understand the vulnerability's scope and impact.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-15T06:22:02.807Z and has not been modified since then.