{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72304", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-09T03:40:39.918Z", "datePublished": "2026-08-15T05:55:22.290Z", "dateUpdated": "2026-08-17T05:42:37.543Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:42:37.543Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put\n\nIn sof_ipc4_bytes_put(), the copy size is derived from the old\ndata->size in the buffer rather than the incoming new data's size\nfield from ucontrol. If the new data has a different size, the copy\nuses the wrong length: it may truncate valid data or copy stale bytes.\n\nFix by validating and using the incoming data's sof_abi_hdr.size from\nucontrol before copying."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached via SNDRV_CTL_IOCTL_ELEM_WRITE on /dev/snd/controlC* through snd_ctl_elem_write_user() -> snd_sof_bytes_put() -> sof_ipc4_bytes_put(); SOF IPC4 bytes controls are a local ALSA ioctl path, not a network-facing service.\nAC:L - An attacker reliably triggers the flaw with two self-controlled ALSA writes: first establish a small cached data->size, then submit a ucontrol whose sof_abi_hdr.size differs; no race against unrelated victim state is required.\nPR:L - Only a local user who can open ALSA control devices on SOF-equipped Intel laptop/desktop audio hardware is required; typical desktop users in the audio group have this access without real root or init-namespace capabilities.\nUI:N - No separate victim action is needed; the attacker issues the control-element write ioctls directly to drive the vulnerable copy and subsequent IPC transmission.\nS:U - Impact is confined to the host kernel SOF/ALSA audio subsystem on the same machine; heap disclosure, IPC misuse, or firmware parameter corruption does not cross VM, container, or IOMMU boundaries.\nC:H - Validating and copying against stale data->size lets attacker-controlled new_hdr->size bypass bounds checks, so sof_ipc4_set_get_bytes_data() and IPC helpers read beyond the kmalloc control buffer, disclosing adjacent kernel heap memory.\nI:H - The mismatched copy leaves attacker-influenced stale kernel bytes in control buffers and forwards unvalidated sizes to firmware IPC (including sof_ipc4_set_bytes_control_data() memcpy paths), enabling bounded but attacker-directed kernel memory corruption.\nA:H - Inflated unvalidated data->size values drive large memcpy/IPC loops past the allocated control payload, which can provoke KASAN faults, unhandled page faults, kernel oops, or panic on SOF systems."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/soc/sof/ipc4-control.c"], "versions": [{"version": "a062c8899fede2ab5660a817e9b602d3fa280a99", "lessThan": "266f936db83aee6ca6473bbb06259bda52bf4fc3", "status": "affected", "versionType": "git"}, {"version": "a062c8899fede2ab5660a817e9b602d3fa280a99", "lessThan": "4cf6a7ebbf8787393b158b2cc341723e5bebc4a8", "status": "affected", "versionType": "git"}, {"version": "a062c8899fede2ab5660a817e9b602d3fa280a99", "lessThan": "fb4293173db2d474d8fbc0e5ecf4943e6df2b40e", "status": "affected", "versionType": "git"}, {"version": "a062c8899fede2ab5660a817e9b602d3fa280a99", "lessThan": "038406abde0d0883419ec89425ea941ec8bbef95", "status": "affected", "versionType": "git"}, {"version": "a062c8899fede2ab5660a817e9b602d3fa280a99", "lessThan": "3ad673e7139cf214afd24321a829aad6575f4163", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/soc/sof/ipc4-control.c"], "versions": [{"version": "6.4", "status": "affected"}, {"version": "0", "lessThan": "6.4", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.97", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.6.145"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.12.97"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/266f936db83aee6ca6473bbb06259bda52bf4fc3"}, {"url": "https://git.kernel.org/stable/c/4cf6a7ebbf8787393b158b2cc341723e5bebc4a8"}, {"url": "https://git.kernel.org/stable/c/fb4293173db2d474d8fbc0e5ecf4943e6df2b40e"}, {"url": "https://git.kernel.org/stable/c/038406abde0d0883419ec89425ea941ec8bbef95"}, {"url": "https://git.kernel.org/stable/c/3ad673e7139cf214afd24321a829aad6575f4163"}], "title": "ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["sound/soc/sof/ipc4-control.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "266f936db83aee6ca6473bbb06259bda52bf4fc3", "status": "affected", "version": "a062c8899fede2ab5660a817e9b602d3fa280a99", "versionType": "git"}, {"lessThan": "4cf6a7ebbf8787393b158b2cc341723e5bebc4a8", "status": "affected", "version": "a062c8899fede2ab5660a817e9b602d3fa280a99", "versionType": "git"}, {"lessThan": "fb4293173db2d474d8fbc0e5ecf4943e6df2b40e", "status": "affected", "version": "a062c8899fede2ab5660a817e9b602d3fa280a99", "versionType": "git"}, {"lessThan": "038406abde0d0883419ec89425ea941ec8bbef95", "status": "affected", "version": "a062c8899fede2ab5660a817e9b602d3fa280a99", "versionType": "git"}, {"lessThan": "3ad673e7139cf214afd24321a829aad6575f4163", "status": "affected", "version": "a062c8899fede2ab5660a817e9b602d3fa280a99", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["sound/soc/sof/ipc4-control.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.4"}, {"lessThan": "6.4", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.145", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.97", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put\n\nIn sof_ipc4_bytes_put(), the copy size is derived from the old\ndata->size in the buffer rather than the incoming new data's size\nfield from ucontrol. If the new data has a different size, the copy\nuses the wrong length: it may truncate valid data or copy stale bytes.\n\nFix by validating and using the incoming data's sof_abi_hdr.size from\nucontrol before copying."}], "id": "CVE-2026-72304", "lastModified": "2026-08-17T06:18:33.467", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-15T06:22:03.120", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/038406abde0d0883419ec89425ea941ec8bbef95"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/266f936db83aee6ca6473bbb06259bda52bf4fc3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3ad673e7139cf214afd24321a829aad6575f4163"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4cf6a7ebbf8787393b158b2cc341723e5bebc4a8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fb4293173db2d474d8fbc0e5ecf4943e6df2b40e"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put", "id": "2516610", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516610"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-805", "details": ["A flaw was found in the Advanced Linux Sound Architecture (ALSA) System on Chip (ASoC) Sound Open Firmware (SOF) ipc4-control component of the Linux kernel. This Time-of-check to time-of-use (TOCTOU) vulnerability occurs in the `sof_ipc4_bytes_put()` function, where the copy size is incorrectly derived from old buffer data instead of the new incoming data. This can lead to either truncating valid data or copying stale bytes, potentially resulting in data corruption."], "name": "CVE-2026-72304", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-72304\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-72304\nhttps://lore.kernel.org/linux-cve-announce/2026081503-CVE-2026-72304-c41a@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a062c8899fede2ab5660a817e9b602d3fa280a99,266f936db83aee6ca6473bbb06259bda52bf4fc3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a062c8899fede2ab5660a817e9b602d3fa280a99,4cf6a7ebbf8787393b158b2cc341723e5bebc4a8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a062c8899fede2ab5660a817e9b602d3fa280a99,fb4293173db2d474d8fbc0e5ecf4943e6df2b40e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a062c8899fede2ab5660a817e9b602d3fa280a99,038406abde0d0883419ec89425ea941ec8bbef95)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a062c8899fede2ab5660a817e9b602d3fa280a99,3ad673e7139cf214afd24321a829aad6575f4163)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.4"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.4)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.145,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.97,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.40,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T19:30:03.292185+00:00", "updated": "2026-08-17T16:45:04.841299+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-365"]}