CVE-2026-72261
High
Description
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control In snd_sof_update_control(), firmware-provided cdata->num_elems is checked against local_cdata->data->size but never against the actual allocation size. If local_cdata->data->size was previously set to an inconsistent value, the memcpy could write past the allocated buffer. Add a bounds check to ensure num_elems fits within the available space in the ipc_control_data allocation before copying.
SeverityHigh
CVSS7.8
Exploit probability—
Product
Linux
PublishedAug 15, 2026
First seenAug 15, 2026
How to fix
Update
- Linux Linux1dc25a3e06364f48c4ef06016852f8b82425151a, ee781058cd4d71e4449f41cbe6a3b8c59daa2c51, ecf67f1302f2080b4d241b973364aacda70ad740, d3abaedf6a58469610136d2dace1a85cddf7afcf, 2a591bf6fd41fd14bdae689aafac4a9ee702c23c, 390aa4c9339bb0ec0bc8d554e830faf93ca9d49e or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 10f461d79c2d1afb22344986cc1b4631169cf25e ≤ v < 1dc25a3e06364f48c4ef06016852f8b82425151a, 10f461d79c2d1afb22344986cc1b4631169cf25e ≤ v < ee781058cd4d71e4449f41cbe6a3b8c59daa2c51, 10f461d79c2d1afb22344986cc1b4631169cf25e ≤ v < ecf67f1302f2080b4d241b973364aacda70ad740, 10f461d79c2d1afb22344986cc1b4631169cf25e ≤ v < d3abaedf6a58469610136d2dace1a85cddf7afcf, 10f461d79c2d1afb22344986cc1b4631169cf25e ≤ v < 2a591bf6fd41fd14bdae689aafac4a9ee702c23c, 10f461d79c2d1afb22344986cc1b4631169cf25e ≤ v < 390aa4c9339bb0ec0bc8d554e830faf93ca9d49e, 5.18 | 1dc25a3e06364f48c4ef06016852f8b82425151a, ee781058cd4d71e4449f41cbe6a3b8c59daa2c51, ecf67f1302f2080b4d241b973364aacda70ad740, d3abaedf6a58469610136d2dace1a85cddf7afcf, 2a591bf6fd41fd14bdae689aafac4a9ee702c23c, 390aa4c9339bb0ec0bc8d554e830faf93ca9d49e |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.