Linux Kernel CVE-2026-72488

Exploitation requires a local user account with at least low-privilege access (confirmed by PR:L in the CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H vector) on a Linux system running an affected kernel version. The vulnerable code path is in the SoundWire audio subsystem: the target must have SoundWire-capable hardware present and the soundwire_bus kernel module actively loaded. Systems without SoundWire hardware - including most servers, older desktops, and virtual machines - will not load this code path and are not exposed. No special non-default configuration is required beyond hardware presence; once the module is active, the flawed function is reachable through normal audio subsystem operations. Exploitation is limited by: (1) requirement for local interactive or code-execution access, (2) physical or virtual presence of SoundWire-capable audio hardware, and (3) unconfirmed ability to convert the out-of-bounds read into a controlled write or reliable privilege escalation primitive.

The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects worst-case kernel memory corruption impact if fully exploited, but real-world risk is materially lower than this score implies. EPSS at 0.21% (11th percentile) indicates negligible observed exploitation activity, there is no CISA KEV listing, and no public proof-of-concept is known. The local attack vector constrains exposure to scenarios where an attacker already has authenticated low-privilege access on a system with SoundWire hardware loaded, meaning server fleets, most VMs, and non-SoundWire desktops are simply not in scope. Even a mid-sized municipal IT team in zabrze would reasonably handle this as a standard kernel patch-cycle item rather than an emergency response, unless they operate multi-tenant Linux hosts where local privilege escalation is a top threat. The critical open question - not resolvable from available data - is whether the OOB read at the array boundary lands on attacker-influenced memory and can be converted to a controlled write primitive; syzkaller confirmed reliable triggering of the condition but a working privilege escalation exploit is not confirmed. Overall this is a medium-priority kernel update, elevated only for multi-user or container-host environments where local-to-root pathways carry higher business risk.

A local user with a low-privilege shell account on a Linux laptop or workstation with SoundWire audio hardware triggers the sdw_add_element_group_count function through crafted interaction with the SoundWire bus interface - for example, via a sequence of ioctl calls or by loading a malicious audio driver module - causing the loop to read one element beyond the end of the rates/lanes array in kernel memory. Depending on what data occupies the adjacent kernel heap slot, this could either crash the kernel (denial of service) or, in a more sophisticated exploit, be leveraged to read sensitive kernel memory or corrupt adjacent structures to redirect execution and escalate to root. No public proof-of-concept exploit exists at time of analysis.