CVE-2026-72304 Linux CVE debrief

Who should care

Linux kernel maintainers, Linux distribution vendors, and users of Linux-based systems that utilize the ASoC SOF ipc4-control component should prioritize patching this TOCTOU vulnerability. They should review and update Linux kernel configurations, monitor for potential exploitation attempts, and track exceptions, retest remediated assets, and close the item only after evidence is documented. Affected operator, platform, vulnerability-management, and security-team impact should be considered when prioritizing patching and mitigation efforts. For example, if the vulnerable component is used in a critical infrastructure system, patching should be prioritized to minimize potential impact. Additionally, defenders should consider compensating controls, such as monitoring and detection, to minimize potential impact in case patching is not feasible in the short term. Asset inventory and rollback/change windows should also be considered when planning mitigation efforts. Source tracking can help defenders stay informed about potential exploitation attempts and new information about the vulnerability. Overall, a comprehensive approach that considers multiple factors is necessary to effectively manage the risk associated with this vulnerability. The vulnerability has a high impact on the Linux kernel and its users, and it is essential to take immediate action to mitigate the risk. The TOCTOU vulnerability can be exploited by attackers to gain unauthorized access to sensitive information or to disrupt system operations. Therefore, it is crucial to prioritize patching and mitigation efforts to minimize potential impact. The Linux kernel maintainers and users should work together to ensure that the vulnerability is patched and that the system is secure. The vulnerability is a significant threat to the Linux kernel and its users, and it is essential to take immediate action to mitigate the risk. The impact of the vulnerability can be significant, and it is crucial to prioritize patching and mitigation efforts to minimize potential impact. The vulnerability affects multiple stakeholders, including Linux kernel maintainers, Linux distribution vendors, and users of Linux-based. A

Technical summary

The Linux kernel's ASoC SOF ipc4-control component has a TOCTOU vulnerability in the sof_ipc4_bytes_put function. The function derives the copy size from the old data->size in the buffer rather than the incoming new data's size field from ucontrol. This can lead to truncation of valid data or copying of stale bytes. The vulnerability affects Linux kernel maintainers, Linux distribution vendors, and users of Linux-based systems that utilize the ASoC SOF ipc4-control component.

Defensive priority

Linux kernel maintainers and users should prioritize patching this TOCTOU vulnerability in the ASoC SOF ipc4-control component.

Recommended defensive actions

• Apply patches from Linux kernel maintainers
• Review and update Linux kernel configurations
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further analysis of the Linux kernel source code and associated documentation may be necessary to fully understand the vulnerability and its potential impact. The vulnerability affects the ASoC SOF ipc4-control component in the Linux kernel. Defenders should verify the affected scope, severity, and vendor guidance. They should also review compensating controls for exposed systems while remediation is scheduled and verified.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.