Strix
64.7K

CVE-2026-93280

HIGHCVSS 8.8/10

Last modified

CVE-2026-93280 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: greybus: audio: bound the topology section sizes against the fetched size gb_audio_gb_get_topology() fetches a topology blob of a module-supplied size, and gbaudio_tplg_parse_data() then walks it by adding the module-supplied size_dais, size_controls and size_widgets fields to form the control, widget and route section offsets. Those le32 sizes are never checked against the fetched blob, so a module reporting a small topology size but large section sizes makes the offsets point past the allocation, and parsing reads out of bounds. Reject a topology whose section sizes do not fit within the fetched size before it is parsed..

Description

In the Linux kernel, the following vulnerability has been resolved: greybus: audio: bound the topology section sizes against the fetched size gb_audio_gb_get_topology() fetches a topology blob of a module-supplied size, and gbaudio_tplg_parse_data() then walks it by adding the module-supplied size_dais, size_controls and size_widgets fields to form the control, widget and route section offsets. Those le32 sizes are never checked against the fetched blob, so a module reporting a small topology size but large section sizes makes the offsets point past the allocation, and parsing reads out of bounds. Reject a topology whose section sizes do not fit within the fetched size before it is parsed.

Metrics

CVSS 3.1
8.8/10

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 184992e305f1de3a3d5fa446da3a2bc76be7c54a, < ba86de9f7b0d7903d2df5ea2373e34d8ca3fc43e; >= 184992e305f1de3a3d5fa446da3a2bc76be7c54a, < dd5593aee0a0fb353e1164aff7b65e563fe1f232; >= 184992e305f1de3a3d5fa446da3a2bc76be7c54a, < 6f764363b3173d805be11e59a8f23ecee2d420d5; >= 184992e305f1de3a3d5fa446da3a2bc76be7c54a, < 52daf9de692ebac813d110eb1e677dc0e1f4a5ab; >= 184992e305f1de3a3d5fa446da3a2bc76be7c54a, < d0f6eaba60705bacd9bb4ce48eab50ef3f546777; >= 184992e305f1de3a3d5fa446da3a2bc76be7c54a, < c9191f2e2f35f1209eb2dc24b31129dd47b48c16; >= 184992e305f1de3a3d5fa446da3a2bc76be7c54a, < cfcc5a41a9664eb68023aae4cd0d485b256bd7c7; >= 184992e305f1de3a3d5fa446da3a2bc76be7c54a, < 33d8c7b794d2a30637c9d3fcb478f1d3222bef1e
LinuxLinux4.9

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-93280?
In the Linux kernel, the following vulnerability has been resolved: greybus: audio: bound the topology section sizes against the fetched size gb_audio_gb_get_topology() fetches a topology blob of a module-supplied size, and gbaudio_tplg_parse_data() then walks it by adding the module-supplied size_dais, size_controls and size_widgets fields to form the control, widget and route section offsets. Those le32 sizes are never checked against the fetched blob, so a module reporting a small topology size but large section sizes makes the offsets point past the allocation, and parsing reads out of bounds. Reject a topology whose section sizes do not fit within the fetched size before it is parsed.
How severe is CVE-2026-93280?
CVE-2026-93280 has a CVSS score of 8.8/10 (HIGH severity).
How do I fix CVE-2026-93280?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-93280?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST