UBUNTU-CVE-2026-99182: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture When chcount is smaller than blob->alhcfg.devicecount (e.g. a mono capture stream, such as a SmartMic, aggregated across multiple SDW links), step = chcount / blob->alhcfg.devicecount truncates to 0. The subsequent GENMASK(step - 1, 0) then underflows step - 1 (u32) to UINTMAX, causing GENMASK()'s internal shift to use an out-of-bounds exponent: UBSAN: shift-out-of-bounds in sound/soc/sof/ipc4-topology.c:2363:13 shift exponent 18446744069414584384 is too large for 64-bit type 'long unsigned int' Treat chcount < devicecount the same way as the existing "channels equal to output reference channels" case: apply the same chmask to every aggregated device instead of trying to split channels that can't be evenly divided.
Affected Software
Event History
Frequently Asked Questions
What stream configuration triggers the fault?
The issue occurs for aggregated ALH capture when the channel count is lower than the number of devices in the ALH configuration. An example given is a mono SmartMic capture stream aggregated across multiple SoundWire links.
What is the immediate effect of the vulnerable calculation?
The channel-per-device calculation truncates to zero, after which subtracting one underflows an unsigned value. This causes GENMASK() to perform a shift with an out-of-bounds exponent, which UBSAN reports as a shift-out-of-bounds condition.
Which Ubuntu kernel packages are listed as affected?
The listed packages are ubuntu/linux, ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, and ubuntu/linux-aws.