Linux Kernel CVE-2026-72304

The vulnerability resides in the ALSA System-on-Chip (ASoC) subsystem's Sound Open Firmware (SOF) IPC4 layer, specifically the kernel/sof/sound/soc/sof/ipc4-control.c path. SOF is Intel's firmware framework for DSP-based audio hardware, and IPC4 is its fourth-generation inter-processor communication protocol. The function sof_ipc4_bytes_put() is called when userspace writes a bytes-type ALSA control value via the snd_kcontrol_new interface. The bug is a Time-Of-Check-Time-Of-Use (TOCTOU) variant: the function reads data->size from the kernel-side buffer (reflecting the previously stored value) as the copy length, instead of using the sof_abi_hdr.size embedded in the incoming ucontrol->value.bytes.data blob. CPE cpe:2.3:a:linux:linux confirms all Linux kernel instances are in scope, but exploitation requires the SOF IPC4 driver stack to be loaded, which is hardware-dependent. Although no formal CWE is assigned in the NVD record, the closest applicable weakness class is CWE-367 (TOCTOU Race Condition) or CWE-20 (Improper Input Validation) since the core flaw is using a pre-existing value rather than validating and consuming the attacker-controlled incoming size.