Linux Kernel EUVD-2026-59161

The vulnerability resides in sound/soc/sof/ipc3-control.c within the Linux kernel's ASoC (Advanced Linux Sound Architecture System on Chip) subsystem, specifically the SOF (Sound Open Firmware) IPC version 3 control path. The ipc_control_data buffer is allocated via kzalloc(max_size) where max_size is designed to cover the full struct sof_ipc_ctrl_data including its trailing flexible array member (cdata->data). The programming error is that bounds validation in bytes_ext_put and bytes_ext_get compared user-controlled lengths directly against max_size without subtracting sizeof(struct sof_ipc_ctrl_data) to account for the fixed-size header preceding the payload region. This is a classic heap buffer overflow (nominally CWE-122/CWE-787, though the NVD entry lists CWE as N/A - a data gap). A secondary bug compounds the issue: the error-path restore in bytes_ext_put wrote to cdata->data instead of cdata, triggering the same overflow on the error path. The ALSA TLV kcontrol interface (/dev/snd/controlC*) is the userspace attack surface, accessible to members of the audio group or via PipeWire/PulseAudio on desktop systems. SOF hardware is most common on Intel-based Chromebooks and modern laptops. No CPE strings were provided in the input data.