Strix
56.7K

CVE-2026-72300

UnknownEPSS 0.20%

Last modified

CVE-2026-72300 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: topology: validate vendor array size before parsing sof_parse_token_sets() reads array->size while iterating over topology private data. The loop condition only checks that some data remains, so a malformed topology with a truncated trailing vendor array can make the parser read the size field before a full vendor-array header is available. Validate that the remaining private data contains a complete snd_soc_tplg_vendor_array header before reading array->size. The declared array size check also needs to remain signed. EPSS estimates a 0.20% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: topology: validate vendor array size before parsing sof_parse_token_sets() reads array->size while iterating over topology private data. The loop condition only checks that some data remains, so a malformed topology with a truncated trailing vendor array can make the parser read the size field before a full vendor-array header is available. Validate that the remaining private data contains a complete snd_soc_tplg_vendor_array header before reading array->size. The declared array size check also needs to remain signed. asize is an int, but sizeof(*array) has type size_t, so comparing them directly promotes negative asize values to unsigned and lets them pass the check, as reported in the stable review thread reference below. Cast sizeof(*array) to int when validating the declared array size. This rejects negative, zero and otherwise too-small sizes before the parser dispatches to the tuple-specific code.

Metrics

EPSS Probability
0.20%

10.2th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 5c37bd025068381f5bdbbf6a5ae3a1da8f6ed928, < 7c6d2d2baeb1e62dc8c6951d27edc16c5ea6e3aa; >= 06d4938e41d62af7b5b3f39eb239f58b21f50443, < a40e250414b463e953c54cd2a829c9a9a49a78c3; >= 55024322915539098f7a7dd318351c7a003ff041, < d34deef34c99bb4b3ebd2ac51058857827a20e7e; >= 215e5fe75881a7e2425df04aeeed47a903d5cd5d, < 201b60c4d15538fcc3c0c2ea9b75dd7d0f58022c; >= 215e5fe75881a7e2425df04aeeed47a903d5cd5d, < 8468dd79cfb2ffbdeaf7c353f63d64941cb8ba05; 756c48bdf23050def518e85929be6edea9ae6823; >= 6.6.136, < 6.6.145; >= 6.12.83, < 6.12.97; >= 6.18.24, < 6.18.40; >= 6.19.14, < 6.20
LinuxLinux7.0

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-72300?
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: topology: validate vendor array size before parsing sof_parse_token_sets() reads array->size while iterating over topology private data. The loop condition only checks that some data remains, so a malformed topology with a truncated trailing vendor array can make the parser read the size field before a full vendor-array header is available. Validate that the remaining private data contains a complete snd_soc_tplg_vendor_array header before reading array->size. The declared array size check also needs to remain signed. asize is an int, but sizeof(*array) has type size_t, so comparing them directly promotes negative asize values to unsigned and lets them pass the check, as reported in the stable review thread reference below. Cast sizeof(*array) to int when validating the declared array size. This rejects negative, zero and otherwise too-small sizes before the parser dispatches to the tuple-specific code.
How severe is CVE-2026-72300?
Severity scoring for CVE-2026-72300 is pending analysis. The EPSS model estimates a 0.20% probability of exploitation in the next 30 days.
How do I fix CVE-2026-72300?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-72300?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST