CVE-2026-72300
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: topology: validate vendor array size before parsing sof_parse_token_sets() reads array->size while iterating over topology private data. The loop condition only checks that some data remains, so a malformed topology with a truncated trailing vendor array can make the parser read the size field before a full vendor-array header is available. Validate that the remaining private data contains a complete snd_soc_tplg_vendor_array header before reading array->size. The declared array size check also needs to remain signed. asize is an int, but sizeof(*array) has type size_t, so comparing them directly promotes negative asize values to unsigned and lets them pass the check, as reported in the stable review thread reference below. Cast sizeof(*array) to int when validating the declared array size. This rejects negative, zero and otherwise too-small sizes before the parser dispatches to the tuple-specific code.
Affected versions
Linux kernel versions
6.6.136,
6.12.83,
6.18.24,
6.19.14,
7.0
and later are affected. Fixed in
6.6.145,
6.12.97,
6.18.40,
7.1.5,
7.2-rc1
and their respective stable series.
References
5 totalFrequently asked questions
-
What is CVE-2026-72300?
CVE-2026-72300 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.6.136 onward and has been patched in 6.6.145, 6.12.97, 6.18.40 and others. CVE-2026-72300 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-72300?
Yes. CVE-2026-72300 has been patched. Fixed versions include 6.6.145, 6.12.97, 6.18.40 and others. If you are running Linux kernel 6.6.136 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-72300 actively exploited?
No. CVE-2026-72300 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.