CVE-2026-90196 (GCVE-0-2026-90196)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:07 – Updated: 2026-09-17 16:07
VLAI
Title
ASoC: SOF: validate topology volume range before allocation
Summary
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: validate topology volume range before allocation SOF treats the topology mixer min and max values as non-negative indices into its volume table. It stores them in signed fields, allocates max + 1 entries through an int argument, and later indexes the table with the stored range. An inverted range is invalid, while a maximum at or above INT_MAX cannot be represented safely after the increment or in the signed fields. Validate the complete range before storing it or allocating the table.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 311ce4fe7637d96608b6e57bf9ebbd8aabcf429e , < 992e130b888699d18da901b593d7a0fb75041a03 (git)
Affected: 311ce4fe7637d96608b6e57bf9ebbd8aabcf429e , < cd63a1eb677e9548ba2d512be5dac4cb474ae145 (git)
Affected: 311ce4fe7637d96608b6e57bf9ebbd8aabcf429e , < 8e1d63f5e272061208455b5aa4cc0d5bcbe5c1a8 (git)
Affected: 311ce4fe7637d96608b6e57bf9ebbd8aabcf429e , < d2f41287b51a3261d447ae38000f7a6f5860663a (git)
Affected: 311ce4fe7637d96608b6e57bf9ebbd8aabcf429e , < 72d0b77412aef2cec554cc84e176658f2a48dafa (git)
Affected: 311ce4fe7637d96608b6e57bf9ebbd8aabcf429e , < a698e4a60fa54268a38f4e66378851a196cb139b (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.2
Unaffected: 0 , < 5.2 (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.52 , ≤ 6.18.* (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/soc/sof/topology.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "992e130b888699d18da901b593d7a0fb75041a03",
              "status": "affected",
              "version": "311ce4fe7637d96608b6e57bf9ebbd8aabcf429e",
              "versionType": "git"
            },
            {
              "lessThan": "cd63a1eb677e9548ba2d512be5dac4cb474ae145",
              "status": "affected",
              "version": "311ce4fe7637d96608b6e57bf9ebbd8aabcf429e",
              "versionType": "git"
            },
            {
              "lessThan": "8e1d63f5e272061208455b5aa4cc0d5bcbe5c1a8",
              "status": "affected",
              "version": "311ce4fe7637d96608b6e57bf9ebbd8aabcf429e",
              "versionType": "git"
            },
            {
              "lessThan": "d2f41287b51a3261d447ae38000f7a6f5860663a",
              "status": "affected",
              "version": "311ce4fe7637d96608b6e57bf9ebbd8aabcf429e",
              "versionType": "git"
            },
            {
              "lessThan": "72d0b77412aef2cec554cc84e176658f2a48dafa",
              "status": "affected",
              "version": "311ce4fe7637d96608b6e57bf9ebbd8aabcf429e",
              "versionType": "git"
            },
            {
              "lessThan": "a698e4a60fa54268a38f4e66378851a196cb139b",
              "status": "affected",
              "version": "311ce4fe7637d96608b6e57bf9ebbd8aabcf429e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/soc/sof/topology.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.2"
            },
            {
              "lessThan": "5.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: validate topology volume range before allocation\n\nSOF treats the topology mixer min and max values as non-negative indices\ninto its volume table. It stores them in signed fields, allocates max + 1\nentries through an int argument, and later indexes the table with the\nstored range.\n\nAn inverted range is invalid, while a maximum at or above INT_MAX cannot\nbe represented safely after the increment or in the signed fields.\nValidate the complete range before storing it or allocating the table."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-17T16:07:15.610Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/992e130b888699d18da901b593d7a0fb75041a03"
        },
        {
          "url": "https://git.kernel.org/stable/c/cd63a1eb677e9548ba2d512be5dac4cb474ae145"
        },
        {
          "url": "https://git.kernel.org/stable/c/8e1d63f5e272061208455b5aa4cc0d5bcbe5c1a8"
        },
        {
          "url": "https://git.kernel.org/stable/c/d2f41287b51a3261d447ae38000f7a6f5860663a"
        },
        {
          "url": "https://git.kernel.org/stable/c/72d0b77412aef2cec554cc84e176658f2a48dafa"
        },
        {
          "url": "https://git.kernel.org/stable/c/a698e4a60fa54268a38f4e66378851a196cb139b"
        }
      ],
      "title": "ASoC: SOF: validate topology volume range before allocation",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90196",
    "datePublished": "2026-09-17T16:07:15.610Z",
    "dateReserved": "2026-09-11T19:38:34.792Z",
    "dateUpdated": "2026-09-17T16:07:15.610Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-90196",
      "date": "2026-09-25",
      "epss": "0.00215",
      "percentile": "0.10579"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "sound/soc/sof/topology.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "992e130b888699d18da901b593d7a0fb75041a03",
                    "status": "affected",
                    "version": "311ce4fe7637d96608b6e57bf9ebbd8aabcf429e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cd63a1eb677e9548ba2d512be5dac4cb474ae145",
                    "status": "affected",
                    "version": "311ce4fe7637d96608b6e57bf9ebbd8aabcf429e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8e1d63f5e272061208455b5aa4cc0d5bcbe5c1a8",
                    "status": "affected",
                    "version": "311ce4fe7637d96608b6e57bf9ebbd8aabcf429e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d2f41287b51a3261d447ae38000f7a6f5860663a",
                    "status": "affected",
                    "version": "311ce4fe7637d96608b6e57bf9ebbd8aabcf429e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "72d0b77412aef2cec554cc84e176658f2a48dafa",
                    "status": "affected",
                    "version": "311ce4fe7637d96608b6e57bf9ebbd8aabcf429e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a698e4a60fa54268a38f4e66378851a196cb139b",
                    "status": "affected",
                    "version": "311ce4fe7637d96608b6e57bf9ebbd8aabcf429e",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "sound/soc/sof/topology.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.2"
                  },
                  {
                    "lessThan": "5.2",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.110",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.52",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: validate topology volume range before allocation\n\nSOF treats the topology mixer min and max values as non-negative indices\ninto its volume table. It stores them in signed fields, allocates max + 1\nentries through an int argument, and later indexes the table with the\nstored range.\n\nAn inverted range is invalid, while a maximum at or above INT_MAX cannot\nbe represented safely after the increment or in the signed fields.\nValidate the complete range before storing it or allocating the table."
          }
        ],
        "id": "CVE-2026-90196",
        "lastModified": "2026-09-17T17:17:14.400",
        "metrics": {},
        "published": "2026-09-17T17:17:14.400",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/72d0b77412aef2cec554cc84e176658f2a48dafa"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8e1d63f5e272061208455b5aa4cc0d5bcbe5c1a8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/992e130b888699d18da901b593d7a0fb75041a03"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a698e4a60fa54268a38f4e66378851a196cb139b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cd63a1eb677e9548ba2d512be5dac4cb474ae145"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d2f41287b51a3261d447ae38000f7a6f5860663a"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.