CVE-2026-93280: greybus: audio: bound the topology section sizes against the fetched size
In the Linux kernel, the following vulnerability has been resolved:
greybus: audio: bound the topology section sizes against the fetched size
gbaudiogbgettopology() fetches a topology blob of a module-supplied size, and gbaudiotplgparsedata() then walks it by adding the module-supplied sizedais, sizecontrols and sizewidgets fields to form the control, widget and route section offsets. Those le32 sizes are never checked against the fetched blob, so a module reporting a small topology size but large section sizes makes the offsets point past the allocation, and parsing reads out of bounds.
Reject a topology whose section sizes do not fit within the fetched size before it is parsed.
Affected Software
Event History
Frequently Asked Questions
What must an attacker control to trigger this issue?
An attacker needs to control or emulate a Greybus audio module that supplies a malformed topology blob. The module must report section sizes that exceed the size of the topology data fetched by the kernel.
What is the impact of a malformed topology?
The kernel can calculate section offsets beyond the allocated topology buffer and then read out of bounds while parsing control, widget, or route data.
How can systems mitigate the issue before applying the fix?
Avoid connecting or trusting unverified Greybus audio modules, since the malformed topology originates from the module. Restrict physical access to systems using Greybus audio hardware where practical.
How does the fix prevent exploitation?
The fix rejects topology data when its module-supplied section sizes do not fit within the fetched topology size, before the topology is parsed.