HIGH Introduced in 4.9
greybus Topology OOB
CVE-2026-93280
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.1MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: greybus: audio: bound the topology section sizes against the fetched size gb_audio_gb_get_topology() fetches a topology blob of a module-supplied size, and gbaudio_tplg_parse_data() then walks it by adding the module-supplied size_dais, size_controls and size_widgets fields to form the control, widget and route section offsets. Those le32 sizes are never checked against the fetched blob, so a module reporting a small topology size but large section sizes makes the offsets point past the allocation, and parsing reads out of bounds. Reject a topology whose section sizes do not fit within the fetched size before it is parsed.
02KernelScan AI Analysis
Risk summary
A malicious Greybus audio module can supply a topology blob with a small reported size but oversized section descriptors, causing the kernel parser to read beyond the allocated buffer. This can leak kernel memory or crash the kernel. The attack requires physical access to connect a malicious Greybus module to a device running the Greybus audio staging driver.
Vulnerability analysis
When a Greybus audio module is connected, the kernel fetches a topology blob whose total size is reported by the module. The parser then walks this blob using separate section-size fields (for DAI, controls, widgets, and routes) that are also module-supplied, without verifying they fit within the fetched buffer. A malicious module can report a small topology size while claiming large section sizes, so the computed offsets point past the allocation and the kernel reads out of bounds. The fix adds a validation step that rejects any topology whose combined section sizes exceed the fetched blob size before parsing begins. The attack requires physical access to plug in a malicious Greybus audio module; no Linux user privileges are needed, but the Greybus staging driver and audio support must be enabled.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.1 | 4.9 | 6.1.188 | 6f764363b317 |
| 6.6 | 4.9 | 6.6.157 | 52daf9de692e |
| 6.18 | 4.9 | 6.18.52 | c9191f2e2f35 |
| 7.2 | 4.9 | 7.2.6 | cfcc5a41a966 |
| mainline | 4.9 | 7.3-rc1 | 33d8c7b794d2 |
| 5.10 | 4.9 | 5.10.270 | ba86de9f7b0d |
| 6.12 | 4.9 | 6.12.110 | d0f6eaba6070 |
| 5.15 | 4.9 | 5.15.221 | dd5593aee0a0 |
| cip/6.12 | 4.9 | 6.12.111-cip32 | d0f6eaba6070 |