CVE-2026-72304ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put In sof_ipc4_bytes_put(), the copy size is derived from the old data->size in the buffer rather than the incoming new data's size field from ucontrol. If the new data has a different size, the copy uses the wrong length: it may truncate valid data or copy stale bytes. Fix by validating and using the incoming data's sof_abi_hdr.size from ucontrol before copying.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from a062c8899fede2ab5660a817e9b602d3fa280a99 before 266f936db83aee6ca6473bbb06259bda52bf4fc3; from a062c8899fede2ab5660a817e9b602d3fa280a99 before 4cf6a7ebbf8787393b158b2cc341723e5bebc4a8; from a062c8899fede2ab5660a817e9b602d3fa280a99 before fb4293173db2d474d8fbc0e5ecf4943e6df2b40e; from a062c8899fede2ab5660a817e9b602d3fa280a99 before 038406abde0d0883419ec89425ea941ec8bbef95; from a062c8899fede2ab5660a817e9b602d3fa280a99 before 3ad673e7139cf214afd24321a829aad6575f4163 | CNA record |
References
- https://git.kernel.org/stable/c/266f936db83aee6ca6473bbb06259bda52bf4fc3
- https://git.kernel.org/stable/c/4cf6a7ebbf8787393b158b2cc341723e5bebc4a8
- https://git.kernel.org/stable/c/fb4293173db2d474d8fbc0e5ecf4943e6df2b40e
- https://git.kernel.org/stable/c/038406abde0d0883419ec89425ea941ec8bbef95
- https://git.kernel.org/stable/c/3ad673e7139cf214afd24321a829aad6575f4163
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.