Bug 2516610 (CVE-2026-72304)

Summary: CVE-2026-72304 kernel: ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Advanced Linux Sound Architecture (ALSA) System on Chip (ASoC) Sound Open Firmware (SOF) ipc4-control component of the Linux kernel. This Time-of-check to time-of-use (TOCTOU) vulnerability occurs in the `sof_ipc4_bytes_put()` function, where the copy size is incorrectly derived from old buffer data instead of the new incoming data. This can lead to either truncating valid data or copying stale bytes, potentially resulting in data corruption.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-15 06:21:46 UTC 
In the Linux kernel, the following vulnerability has been resolved:

ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put

In sof_ipc4_bytes_put(), the copy size is derived from the old
data->size in the buffer rather than the incoming new data's size
field from ucontrol. If the new data has a different size, the copy
uses the wrong length: it may truncate valid data or copy stale bytes.

Fix by validating and using the incoming data's sof_abi_hdr.size from
ucontrol before copying.
Comment 1 Keith Grant 2026-08-18 19:49:46 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026081503-CVE-2026-72304-c41a@gregkh/T