Linux Kernel EUVD-2026-59201

The vulnerable component is located in the Linux kernel's ASoC (ALSA System on Chip) layer within the Sound Open Firmware (SOF) IPC3 protocol handler, found in sound/soc/sof/ipc3-control.c. Intel's SOF architecture offloads audio processing to a dedicated DSP running open firmware; IPC3 is the inter-processor communication protocol used between the host kernel driver and that firmware. The function sof_ipc3_control_update() processes firmware responses and uses cdata->num_elems - a value originating from firmware - in expected_size arithmetic. On 32-bit kernel builds, this multiplication and subsequent addition can silently overflow a 32-bit unsigned integer, wrapping to a small value. The resulting expected_size incorrectly satisfies the comparison against cdata->rhdr.hdr.size, permitting the kernel to enter snd_sof_update_control with a dangerously mismatched size assumption, producing an out-of-bounds memory access. No CWE was formally assigned by NVD, but the root cause is integer overflow leading to buffer over-read or over-write (matching CWE-190 → CWE-125/CWE-787). The fix introduces check_mul_overflow() and check_add_overflow() to detect and reject overflowed calculations. The CPE identifier is cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.