CVE-2026-72488

Summary

In the Linux kernel, the following vulnerability has been resolved:

soundwire: fix bug in sdw_add_element_group_count found by syzkaller

The original implementation caused an out-of-bounds memory access in the sdw_add_element_group_count for-loop when i == num.

for (i = 0; i <= num; i++) { if (rate == group->rates[i] && lane == group->lanes[i]) …

To fix this error, the function now checks for existing rate/lane entries in the group(a function parameter) using a for-loop before adding them.

No functional changes apart from this fix.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux9026118f20e28f202dab34f219bbb831ffb8c4dc < a454f61747c97e2eadaa7a35ffc1f4b1645c6a53affected
LinuxLinux9026118f20e28f202dab34f219bbb831ffb8c4dc < e483a406a23a92d5202e8d324f206e127eef48ffaffected
LinuxLinux9026118f20e28f202dab34f219bbb831ffb8c4dc < f772ff5a0e6758fd412803c09e03ba3bca5f5878affected
LinuxLinux5.10affected
LinuxLinux0 < 5.10unaffected
LinuxLinux6.18.40 <= 6.18.*unaffected
LinuxLinux7.1.5 <= 7.1.*unaffected
LinuxLinux7.2 <= *unaffected

Weaknesses

References