CVE-2026-72302 Linux CVE debrief

Who should care

Linux kernel developers and users who manage or use systems with the ASoC: SOF: ipc3-control component should be aware of this vulnerability. They should review the official advisory and apply patches or mitigations as recommended. Additionally, operators and security teams responsible for platform security, vulnerability management, and incident response should assess the impact on their environments and prioritize remediation efforts accordingly. This includes verifying the firmware-provided cdata->num_elems value and ensuring that check_mul_overflow() and check_add_overflow() are used to detect and reject overflowed size calculations. Those responsible for monitoring and detection should also prepare for potential exploitation attempts and review compensating controls for exposed systems while remediation is scheduled and verified. Asset inventory management and change management processes should be updated to reflect the necessary updates and mitigations. Those tracking the vulnerability should also consider rollback/change windows for affected systems and verify the effectiveness of implemented controls through testing and validation procedures. Security teams should also document and track exceptions, retest remediated assets, and close the item only after evidence is documented. This requires coordination across development, operations, and security teams to ensure comprehensive mitigation and minimize potential impact. The vulnerability's resolution involves using check_mul_overflow() and check_add_overflow() to detect and reject overflowed size calculations, and it is essential for all stakeholders to understand the vulnerability's implications and take necessary actions to prevent exploitation. Linux distributions and maintainers should also review and apply the necessary patches or updates to affected packages. Users of affected systems should prioritize patching or applying recommended mitigations to prevent potential out-of-bounds access in snd_sof_update_control. The Linux kernel community and relevant open-source projects should also be informed about the vulnerability and its fix to ensure widespread awareness and adoption of the solution. In the

Technical summary

The Linux kernel has a vulnerability in the ASoC: SOF: ipc3-control component. The vulnerability is related to the use of overflow checks in control_update size calculation. The expected_size calculation uses firmware-provided cdata->num_elems in arithmetic that could overflow on 32-bit platforms, wrapping to a small value. This could allow the cdata->rhdr.hdr.size comparison to pass with mismatched sizes, potentially leading to out-of-bounds access in snd_sof_update_control. The fix involves using check_mul_overflow() and check_add_overflow() to detect and reject overflowed size calculations.

Defensive priority

High

Recommended defensive actions

• Apply the patch from the Linux kernel repository
• Use check_mul_overflow() and check_add_overflow() to detect and reject overflowed size calculations
• Verify the firmware-provided cdata->num_elems value
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability is caused by the lack of overflow checks in the control_update size calculation. The expected_size calculation uses firmware-provided cdata->num_elems in arithmetic that could overflow on 32-bit platforms. This could allow the cdata->rhdr.hdr.size comparison to pass with mismatched sizes, potentially leading to out-of-bounds access in snd_sof_update_control. The fix involves using check_mul_overflow() and check_add_overflow() to detect and reject overflowed size calculations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.