CVE-2026-72302

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc In sof_ipc3_control_update(), the expected_size calculation uses firmware-provided cdata->num_elems in arithmetic that could overflow on 32-bit platforms, wrapping to a small value. This would allow the cdata->rhdr.hdr.size comparison to pass with mismatched sizes, potentially leading to out-of-bounds access in snd_sof_update_control. Use check_mul_overflow() and check_add_overflow() to detect and reject overflowed size calculations.

Affected products

Kernel, Linux, Linux-Allwinner-5.19, Linux-Aws, Linux-Aws-5.0, Linux-Aws-5.11, Linux-Aws-5.13, Linux-Aws-5.19

CVSS 3.1

7.8 HIGH

EPSS

0.2% (7th percentile)

NVD status

Received

Published

2026-08-15

No exploit for CVE-2026-72302 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.