FKIE_CVE-2026-90196

Vulnerability from fkie_nvd - Published: 2026-09-17 17:17 - Updated: 2026-09-17 17:17
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: validate topology volume range before allocation SOF treats the topology mixer min and max values as non-negative indices into its volume table. It stores them in signed fields, allocates max + 1 entries through an int argument, and later indexes the table with the stored range. An inverted range is invalid, while a maximum at or above INT_MAX cannot be represented safely after the increment or in the signed fields. Validate the complete range before storing it or allocating the table.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/72d0b77412aef2cec554cc84e176658f2a48dafa
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/8e1d63f5e272061208455b5aa4cc0d5bcbe5c1a8
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/992e130b888699d18da901b593d7a0fb75041a03
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a698e4a60fa54268a38f4e66378851a196cb139b
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/cd63a1eb677e9548ba2d512be5dac4cb474ae145
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d2f41287b51a3261d447ae38000f7a6f5860663a
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/soc/sof/topology.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "992e130b888699d18da901b593d7a0fb75041a03",
              "status": "affected",
              "version": "311ce4fe7637d96608b6e57bf9ebbd8aabcf429e",
              "versionType": "git"
            },
            {
              "lessThan": "cd63a1eb677e9548ba2d512be5dac4cb474ae145",
              "status": "affected",
              "version": "311ce4fe7637d96608b6e57bf9ebbd8aabcf429e",
              "versionType": "git"
            },
            {
              "lessThan": "8e1d63f5e272061208455b5aa4cc0d5bcbe5c1a8",
              "status": "affected",
              "version": "311ce4fe7637d96608b6e57bf9ebbd8aabcf429e",
              "versionType": "git"
            },
            {
              "lessThan": "d2f41287b51a3261d447ae38000f7a6f5860663a",
              "status": "affected",
              "version": "311ce4fe7637d96608b6e57bf9ebbd8aabcf429e",
              "versionType": "git"
            },
            {
              "lessThan": "72d0b77412aef2cec554cc84e176658f2a48dafa",
              "status": "affected",
              "version": "311ce4fe7637d96608b6e57bf9ebbd8aabcf429e",
              "versionType": "git"
            },
            {
              "lessThan": "a698e4a60fa54268a38f4e66378851a196cb139b",
              "status": "affected",
              "version": "311ce4fe7637d96608b6e57bf9ebbd8aabcf429e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/soc/sof/topology.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.2"
            },
            {
              "lessThan": "5.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: validate topology volume range before allocation\n\nSOF treats the topology mixer min and max values as non-negative indices\ninto its volume table. It stores them in signed fields, allocates max + 1\nentries through an int argument, and later indexes the table with the\nstored range.\n\nAn inverted range is invalid, while a maximum at or above INT_MAX cannot\nbe represented safely after the increment or in the signed fields.\nValidate the complete range before storing it or allocating the table."
    }
  ],
  "id": "CVE-2026-90196",
  "lastModified": "2026-09-17T17:17:14.400",
  "metrics": {},
  "published": "2026-09-17T17:17:14.400",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/72d0b77412aef2cec554cc84e176658f2a48dafa"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/8e1d63f5e272061208455b5aa4cc0d5bcbe5c1a8"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/992e130b888699d18da901b593d7a0fb75041a03"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/a698e4a60fa54268a38f4e66378851a196cb139b"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/cd63a1eb677e9548ba2d512be5dac4cb474ae145"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/d2f41287b51a3261d447ae38000f7a6f5860663a"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.