Linux Kernel EUVD-2026-59200

The vulnerability resides in the ASoC (ALSA System on Chip) SOF (Sound Open Firmware) IPC3 control layer - the interface between the Linux audio subsystem and DSP firmware on Intel and compatible platforms. In sof_ipc3_bytes_put(), the size argument passed to memcpy is taken from data->size in the existing kernel buffer rather than from the incoming user-controlled sof_abi_hdr.size field in ucontrol, creating a TOCTOU-class logical error: if the new payload has a different declared size than the stale buffer value, the copy either truncates valid data or reads past the end of the new payload. In sof_ipc3_bytes_get(), the bounds check compares data->size against max_size without subtracting sizeof(struct sof_ipc_ctrl_data), which is the fixed-size header preceding the flex array within the allocation. This means the check allows accesses up to sizeof(*cdata) bytes beyond the actually available flex-array space. The CPE strings (cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*) confirm the affected product is mainline Linux. No CWE is formally assigned; the root cause class is CWE-362 (TOCTOU Race Condition) for bytes_put and CWE-131 / CWE-193 (Incorrect Calculation of Buffer Size / Off-by-one) for bytes_get.