CVE-2026-72262: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get
In the Linux kernel, the following vulnerability has been resolved:
ASoC: SOF: ipc3-control: Fix heap overflow in bytesext put/get
The ipccontroldata buffer is allocated as kzalloc(maxsize), where maxsize covers the entire struct sofipcctrldata including its flexible array payload. However, the bounds checks in bytesextput and bytesextget compared user data lengths against maxsize directly, ignoring that cdata->data sits at an offset of sizeof(struct sofipcctrldata) bytes into the allocation.
This allowed writing up to sizeof(struct sofipcctrldata) bytes past the end of the heap buffer from unprivileged userspace via the ALSA TLV kcontrol interface, and similarly allowed over-reading adjacent heap data on the get path.
Fix all bounds checks to subtract sizeof(cdata) from maxsize so they reflect the actual space available at the cdata->data offset. Also fix the error-path restore in bytesextput which wrote to cdata->data instead of cdata, causing the same overflow.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Limit access to the ALSA TLV kcontrol interface (ipc3-control) so unprivileged userspace cannot reach the vulnerable bytes_ext_put/bytes_ext_get paths (e.g., restrict which users/groups can use ALSA controls).
- Operational
Reboot or reload the affected kernel/driver after applying the fix for the ipc3-control heap overflow in bytes_ext put/get and related bounds checks (max_size should be adjusted by subtracting sizeof(*cdata) from the maximum size for bounds checking at the cdata->data offset).