HIGH Introduced in 5.2
sof VolumeRange Overflow
CVE-2026-90196
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: validate topology volume range before allocation SOF treats the topology mixer min and max values as non-negative indices into its volume table. It stores them in signed fields, allocates max + 1 entries through an int argument, and later indexes the table with the stored range. An inverted range is invalid, while a maximum at or above INT_MAX cannot be represented safely after the increment or in the signed fields. Validate the complete range before storing it or allocating the table.
02KernelScan AI Analysis
Risk summary
A crafted audio topology file can cause an integer overflow in the SOF volume table allocation, leading to an undersized buffer that is later indexed out of bounds. This results in kernel heap memory corruption exploitable for privilege escalation or denial of service. Any local user who can supply or influence topology data loaded by the SOF audio driver is at risk.
Vulnerability analysis
The SOF audio topology loader accepts mixer min and max values from a topology blob without validating them. When the max value is at or near INT_MAX, the expression max + 1 overflows, causing a far-too-small allocation for the volume table. The loader then stores the original large max value and uses it to index into the undersized table, producing an out-of-bounds write on kernel heap memory. An inverted range (min greater than max) is likewise accepted despite being nonsensical. The fix validates the complete range before any storage or allocation occurs, rejecting topology blobs where min exceeds max or where max is at or above INT_MAX. The vulnerable path is reachable locally by anyone who can supply a crafted topology to the SOF driver, which on some systems is accessible without root privileges through the audio device interface.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.1 | 5.2 | 6.1.188 | 992e130b8886 |
| 7.2 | 5.2 | 7.2.6 | 72d0b77412ae |
| mainline | 5.2 | 7.3-rc1 | a698e4a60fa5 |
| 6.12 | 5.2 | 6.12.110 | 8e1d63f5e272 |
| 6.6 | 5.2 | 6.6.157 | cd63a1eb677e |
| 6.18 | 5.2 | 6.18.52 | d2f41287b51a |
| cip/6.12 | 5.2 | 6.12.111-cip32 | 8e1d63f5e272 |