Linux Kernel EUVD-2026-86152

Requires the kernel to be built with Greybus audio support (CONFIG_GREYBUS + greybus audio codec/topology parsing) AND an attacker able to present a malicious or compromised Greybus module on the UniPro/Greybus interconnect. The module must return a topology blob whose declared le32 section sizes (size_dais, size_controls, size_widgets) exceed the fetched blob size. Exploitation is limited to environments that actually use Greybus audio hardware - a rare configuration - and needs attacker control over the connected module rather than any network position, so despite AV:A the realistic access requirement is physical/hardware attachment of a rogue module.

The 8.8 CVSS is anchored on AV:A/AC:L/PR:N/UI:N with C:H/I:H/A:H, but that vector is generous for what the code actually does. The bug is a bounds-check omission where a Greybus module supplies both the topology blob size and the per-section sizes (size_dais/size_controls/size_widgets); parsing then reads out of bounds. Critically, the described primitive is a READ ('parsing reads out of bounds'), which supports C:H (info disclosure) and A:H (crash/panic) but does NOT support I:H - there is no described write or integrity corruption, so I:H is overstated. The threat model is also narrower than AV:A implies: the attacker must be a malicious or compromised Greybus module physically/hardware-attached to the UniPro bus, which is closer to physical/adjacent access than typical network adjacency - I assess AV:P. No EPSS, no CISA KEV listing, and no public POC were provided, so there is no signal of active or imminent exploitation; combined with the extremely niche attack surface (Greybus audio is rarely compiled in and requires attacker-controlled hardware), real-world priority is LOW despite the high nominal score. Patches are confirmed available across many stable branches.

An attacker who can attach or compromise a Greybus module presents a crafted audio topology that reports a small overall blob size while declaring large size_dais/size_controls/size_widgets values. When the kernel walks the topology, the computed control/widget/route section offsets land past the allocated buffer, causing an out-of-bounds read that can leak adjacent kernel memory or crash the host. No public exploit code was identified at the time of analysis.