{"id":"CVE-2026-72300","summary":"ASoC: SOF: topology: validate vendor array size before parsing","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: topology: validate vendor array size before parsing\n\nsof_parse_token_sets() reads array-\u003esize while iterating over topology\nprivate data. The loop condition only checks that some data remains, so a\nmalformed topology with a truncated trailing vendor array can make the\nparser read the size field before a full vendor-array header is available.\n\nValidate that the remaining private data contains a complete\nsnd_soc_tplg_vendor_array header before reading array-\u003esize.\n\nThe declared array size check also needs to remain signed. asize is an int,\nbut sizeof(*array) has type size_t, so comparing them directly promotes\nnegative asize values to unsigned and lets them pass the check,\nas reported in the stable review thread reference below.\n\nCast sizeof(*array) to int when validating the declared array size. This\nrejects negative, zero and otherwise too-small sizes before the parser\ndispatches to the tuple-specific code.","modified":"2026-10-08T02:51:46.311959431Z","published":"2026-08-15T05:55:19.786Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72300.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/201b60c4d15538fcc3c0c2ea9b75dd7d0f58022c"},{"type":"WEB","url":"https://git.kernel.org/stable/c/7c6d2d2baeb1e62dc8c6951d27edc16c5ea6e3aa"},{"type":"WEB","url":"https://git.kernel.org/stable/c/8468dd79cfb2ffbdeaf7c353f63d64941cb8ba05"},{"type":"WEB","url":"https://git.kernel.org/stable/c/a40e250414b463e953c54cd2a829c9a9a49a78c3"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d34deef34c99bb4b3ebd2ac51058857827a20e7e"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72300.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72300"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"5c37bd025068381f5bdbbf6a5ae3a1da8f6ed928"},{"fixed":"7c6d2d2baeb1e62dc8c6951d27edc16c5ea6e3aa"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"06d4938e41d62af7b5b3f39eb239f58b21f50443"},{"fixed":"a40e250414b463e953c54cd2a829c9a9a49a78c3"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"55024322915539098f7a7dd318351c7a003ff041"},{"fixed":"d34deef34c99bb4b3ebd2ac51058857827a20e7e"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"215e5fe75881a7e2425df04aeeed47a903d5cd5d"},{"fixed":"201b60c4d15538fcc3c0c2ea9b75dd7d0f58022c"},{"fixed":"8468dd79cfb2ffbdeaf7c353f63d64941cb8ba05"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"6.6.136"},{"fixed":"6.6.145"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"6.12.83"},{"fixed":"6.12.97"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"6.18.24"},{"fixed":"6.18.40"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"6.19.14"},{"fixed":"6.20"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"756c48bdf23050def518e85929be6edea9ae6823"}]}],"versions":["v6.6.144","v6.6.143","v6.6.142","v6.6.141","v6.6.140","v6.6.139","v6.6.138","v6.6.137","v6.6.136","v6.12.96","v6.12.95","v6.12.94","v6.12.93","v6.12.92","v6.12.91","v6.12.90","v6.12.89","v6.12.88","v6.12.87","v6.12.86","v6.12.85","v6.12.84","v6.12.83","v6.18.39","v6.18.38","v6.18.37","v6.18.36","v6.18.35","v6.18.34","v6.18.33","v6.18.32","v6.18.31","v6.18.30","v6.18.29","v6.18.28","v6.18.27","v6.18.26","v6.18.25","v6.18.24","v6.19.14"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72300.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.145"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.97"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.40"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.5"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72300.json"}}],"schema_version":"1.9.0"}