« Volver al listado

CVE-2026-72262

Estado: RecibidaAlta (7.8)—

In the Linux kernel, the following vulnerability has been resolved:

ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get

The ipc_control_data buffer is allocated as kzalloc(max_size), where max_size covers the entire struct sof_ipc_ctrl_data including its flexible array payload. However, the bounds checks in bytes_ext_put and _bytes_ext_get compared user data lengths against max_size directly, ignoring that cdata->data sits at an offset of sizeof(struct sof_ipc_ctrl_data) bytes into the allocation.

This allowed writing up to sizeof(struct sof_ipc_ctrl_data) bytes past the end of the heap buffer from unprivileged userspace via the ALSA TLV kcontrol interface, and similarly allowed over-reading adjacent heap data on the get path.

Leer descripción completaMostrar menos

Fix all bounds checks to subtract sizeof(*cdata) from max_size so they reflect the actual space available at the cdata->data offset. Also fix the error-path restore in bytes_ext_put which wrote to cdata->data instead of cdata, causing the same overflow.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Desbordamiento de heap en kernel Linux exploitable por usuario no privilegiado (PR:L) para ejecutar código arbitrario. AV:L, acceso local sin interacción (UI:N) = escalada de privilegios (T1068). Los impactos son ejecución de código, corrupción de datos en memoria adyacente, y acceso a datos del ker

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Execution PreventionThreat Intelligence ProgramRestrict Web-Based ContentRestrict File and Directory PermissionsPrivileged Account ManagementRemote Data Storage

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-72262",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "67ec2a091630c28ea8d05db2bd7178a05b04b7e6",
              "lessThan": "af4b437a463ac0482ba705434a44da06783778e6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "67ec2a091630c28ea8d05db2bd7178a05b04b7e6",
              "lessThan": "1adde1941bba7b0d7104b86ed819d48d81cb0ad9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "67ec2a091630c28ea8d05db2bd7178a05b04b7e6",
              "lessThan": "eaa67e139c9217099e2a7b717aeeb46c65de3494",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "67ec2a091630c28ea8d05db2bd7178a05b04b7e6",
              "lessThan": "121577383b5cf221e86581e0f2bcca4c66f17469",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "67ec2a091630c28ea8d05db2bd7178a05b04b7e6",
              "lessThan": "f4933e1d11b97b6a0951648b7c3e53850e1b33a9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "67ec2a091630c28ea8d05db2bd7178a05b04b7e6",
              "lessThan": "fd46668d538993218eea19c6925c868ac0f2630c",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "sound/soc/sof/ipc3-control.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.18",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "sound/soc/sof/ipc3-control.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-08-15T06:21:54.443",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/121577383b5cf221e86581e0f2bcca4c66f17469",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/1adde1941bba7b0d7104b86ed819d48d81cb0ad9",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/af4b437a463ac0482ba705434a44da06783778e6",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/eaa67e139c9217099e2a7b717aeeb46c65de3494",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f4933e1d11b97b6a0951648b7c3e53850e1b33a9",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/fd46668d538993218eea19c6925c868ac0f2630c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get\n\nThe ipc_control_data buffer is allocated as kzalloc(max_size), where\nmax_size covers the entire struct sof_ipc_ctrl_data including its\nflexible array payload. However, the bounds checks in bytes_ext_put\nand _bytes_ext_get compared user data lengths against max_size\ndirectly, ignoring that cdata->data sits at an offset of\nsizeof(struct sof_ipc_ctrl_data) bytes into the allocation.\n\nThis allowed writing up to sizeof(struct sof_ipc_ctrl_data) bytes past\nthe end of the heap buffer from unprivileged userspace via the ALSA TLV\nkcontrol interface, and similarly allowed over-reading adjacent heap\ndata on the get path.\n\nFix all bounds checks to subtract sizeof(*cdata) from max_size so they\nreflect the actual space available at the cdata->data offset. Also fix\nthe error-path restore in bytes_ext_put which wrote to cdata->data\ninstead of cdata, causing the same overflow."
    }
  ],
  "lastModified": "2026-08-23T13:16:42.910",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}