CVE-2026-72304
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
In the Linux kernel, the sof_ipc4_bytes_put() function has a TOCTOU vulnerability where the copy size is derived from the old buffer instead of the new data. This can lead to truncation of valid data or copying stale bytes.
Risk Assessment
An attacker could exploit this to corrupt data integrity or potentially gain unauthorized access to kernel memory.
Recommendation
Apply the Linux kernel patch that validates and uses the size from the incoming data before copying.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put In sof_ipc4_bytes_put(), the copy size is derived from the old data->size in the buffer rather than the incoming new data's size field from ucontrol. If the new data has a different size, the copy uses the wrong length: it may truncate valid data or copy stale bytes. Fix by validating and using the incoming data's sof_abi_hdr.size from ucontrol before copying.