Linux Kernel CVE-2026-72261

The vulnerability is in the Linux kernel's ASoC (Audio System on Chip) SOF (Sound Open Firmware) IPC3 (Inter-Processor Communication v3) control subsystem. The function snd_sof_update_control() processes firmware-supplied control data structures: it validates the firmware-provided cdata->num_elems field against local_cdata->data->size, but that data->size field may itself hold a stale or inconsistent value that does not accurately reflect the actual allocation size of the underlying ipc_control_data heap buffer. Because no secondary bounds check against the real allocation size is performed before the memcpy, an attacker who can influence the state of local_cdata->data->size (or exploit pre-existing inconsistency) can cause the copy to overrun the heap buffer. Although NVD did not assign a CWE, this maps to CWE-787 (Out-of-bounds Write): a write operation that exceeds the boundary of a heap allocation, capable of corrupting adjacent kernel data structures or metadata. SOF is the firmware stack for Intel audio DSPs and is active on a broad range of modern Intel-based consumer and enterprise laptops (Tiger Lake, Alder Lake, Raptor Lake generations and onwards).