CVE-2026-72262

CVE-2026-72262 is a heap buffer overflow in the Linux kernel's SOF (Sound Open Firmware) audio driver IPC path. The bug lives in the bounds-checking logic for user-controlled data that gets copied into a kernel buffer allocated for struct sof_ipc_ctrl_data. The developer allocated kzalloc(max_size) — the correct amount of memory — but then wrote length validation that compared the user-provided size directly against max_size without accounting for the struct header that precedes the flexible array member where cdata->data actually lives. This off-by-constant error causes the kernel to copy up to sizeof(struct sof_ipc_ctrl_data) bytes past the end of the allocated buffer. A secondary manifestation of the same underlying mistake appears in an error-path restore operation that writes to cdata->data instead of cdata — the offset subtraction that was missing from the main path was also absent here. This dual appearance is characteristic of code written under time pressure where pattern reuse outpaces individual verification. The exposure model is the critical dimension that CVSS 7.8 undersells. This code path is reachable from unprivileged userspace through the ALSA TLV kcontrol interface. Any local user can trigger a controlled-length heap overflow in kernel memory. The overflow length is predictable — it's the full sizeof(struct sof_ipc_ctrl_data) — which constrains the exploit but also makes it reliable. An attacker who triggers this overflow can target adjacent kernel heap objects, particularly refcounts or vtable pointers that reside in the same slab cache, to achieve privilege escalation. The fix subtracts sizeof(*cdata) from the bounds checks everywhere they appear. This is the correct remediation for this instance, but it follows a pattern seen across the kernel for over a decade: the same off-by-header-size error has appeared in v4l2, media drivers, netfilter hooks, and now SOF ipc3. Each CVE patch solves one instance without structural remedies. The kernel's explicit offset management philosophy — chosen to enable human review — has the side effect of making this bookkeeping error class transferable across code paths through copy-paste. The ipc3/ipc4 split likely contributed: ipc3 sits in the legacy shadow of its successor, receiving less review attention, which allowed the bug to survive undetected. Prioritise patching this immediately in any kernel version shipping SOF audio driver support. The attack surface is accessible to unprivileged local users and produces a controlled overflow that should be considered exploitable for privilege escalation in practice, not just in theory.

Reviewed through automated stages and approved by a human before publication.