DEBIAN-CVE-2026-99182: Debian/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture When chcount is smaller than blob->alhcfg.devicecount (e.g. a mono capture stream, such as a SmartMic, aggregated across multiple SDW links), step = chcount / blob->alhcfg.devicecount truncates to 0. The subsequent GENMASK(step - 1, 0) then underflows step - 1 (u32) to UINTMAX, causing GENMASK()'s internal shift to use an out-of-bounds exponent: UBSAN: shift-out-of-bounds in sound/soc/sof/ipc4-topology.c:2363:13 shift exponent 18446744069414584384 is too large for 64-bit type 'long unsigned int' Treat chcount < devicecount the same way as the existing "channels equal to output reference channels" case: apply the same chmask to every aggregated device instead of trying to split channels that can't be evenly divided.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In SOF IPC4 topology handling for aggregated ALH capture, treat ch_count < blob->alh_cfg.device_count like the channels-equal-to-output-reference-channels case: apply the same ch_mask to every aggregated device instead of splitting channels, preventing step from truncating to 0 and causing the GENMASK shift-out-of-bounds.