PT-2026-37451 · Linux · Linux

Published 2026-05-06 · Updated 2026-05-06 · CVE-2025-71286

Mitre

In the Linux kernel, the following vulnerability has been resolved:

ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls

The size of the data behind of scontrol->ipc control data for bytes controls is: [1] sizeof(struct sof ipc4 control data) + // kernel only struct [2] sizeof(struct sof abi hdr)) + payload

The max size specifies the size of [2] and it is coming from topology.

Change the function to take this into account and allocate adequate amount of memory behind scontrol->ipc control data.

With the change we will allocate [1] amount more memory to be able to hold the full size of data.

Related Identifiers

CVE-2025-71286

Affected Products

Linux

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-71286 · Security Note
• https://git.kernel.org/stable/c/491956b45b5f4933632ea6d8a8bdfdf045ab81e1 · Note
• https://git.kernel.org/stable/c/1237cd9ff198cb882402572f29569e5247190974 · Note
• https://git.kernel.org/stable/c/a653820700b81c9e6f05ac23b7969ecec1a18e85 · Note
• https://git.kernel.org/stable/c/a704a1a4394b5877b9adc31b2c3165ad0b541896 · Note
• https://git.kernel.org/stable/c/59fe643f21b9d59bcbedb0dfbf988ee455c23736 · Note