Answer in brief
CVE-2026-72261 records a Unknown severity vulnerability in ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=10f461d79c2d1afb22344986cc1b4631169cf25e <1dc25a3e06364f48c4ef06016852f8b82425151a || >=10f461d79c2d1afb22344986cc1b4631169cf25e <ee781058cd4d71e4449f41cbe6a3b8c59daa2c51 || >=10f461d79c2d1afb22344986cc1b4631169cf25e <ecf67f1302f2080b4d241b973364aacda70ad740 || >=10f461d79c2d1afb22344986cc1b4631169cf25e <d3abaedf6a58469610136d2dace1a85cddf7afcf || >=10f461d79c2d1afb22344986cc1b4631169cf25e <2a591bf6fd41fd14bdae689aafac4a9ee702c23c || >=10f461d79c2d1afb22344986cc1b4631169cf25e <390aa4c9339bb0ec0bc8d554e830faf93ca9d49e | 1dc25a3e06364f48c4ef06016852f8b82425151a, ee781058cd4d71e4449f41cbe6a3b8c59daa2c51, ecf67f1302f2080b4d241b973364aacda70ad740, d3abaedf6a58469610136d2dace1a85cddf7afcf, 2a591bf6fd41fd14bdae689aafac4a9ee702c23c, 390aa4c9339bb0ec0bc8d554e830faf93ca9d49e |
| Linux/Linuxgeneric | 5.18 | Not reported |
Published upstream
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 15, 2026
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control In snd_sof_update_control(), firmware-provided cdata->num_elems is checked against local_cdata->data->size but never against the actual allocation size. If local_cdata->data->size was previously set to an inconsistent value, the memcpy could write past the allocated buffer. Add a bounds check to ensure num_elems fits within the available space in the ipc_control_data allocation before copying.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-72261 records a Unknown severity vulnerability in ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=10f461d79c2d1afb22344986cc1b4631169cf25e <1dc25a3e06364f48c4ef06016852f8b82425151a || >=10f461d79c2d1afb22344986cc1b4631169cf25e <ee781058cd4d71e4449f41cbe6a3b8c59daa2c51 || >=10f461d79c2d1afb22344986cc1b4631169cf25e <ecf67f1302f2080b4d241b973364aacda70ad740 || >=10f461d79c2d1afb22344986cc1b4631169cf25e <d3abaedf6a58469610136d2dace1a85cddf7afcf || >=10f461d79c2d1afb22344986cc1b4631169cf25e <2a591bf6fd41fd14bdae689aafac4a9ee702c23c || >=10f461d79c2d1afb22344986cc1b4631169cf25e <390aa4c9339bb0ec0bc8d554e830faf93ca9d49e | 1dc25a3e06364f48c4ef06016852f8b82425151a, ee781058cd4d71e4449f41cbe6a3b8c59daa2c51, ecf67f1302f2080b4d241b973364aacda70ad740, d3abaedf6a58469610136d2dace1a85cddf7afcf, 2a591bf6fd41fd14bdae689aafac4a9ee702c23c, 390aa4c9339bb0ec0bc8d554e830faf93ca9d49e |
| Linux/Linuxgeneric | 5.18 | Not reported |
Published upstream
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 15, 2026
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control In snd_sof_update_control(), firmware-provided cdata->num_elems is checked against local_cdata->data->size but never against the actual allocation size. If local_cdata->data->size was previously set to an inconsistent value, the memcpy could write past the allocated buffer. Add a bounds check to ensure num_elems fits within the available space in the ipc_control_data allocation before copying.
Quoted source text, attributed separately from HOL analysis.