SB2026102986 - Integer underflow in Linux kernel soc sof

Description

This security bulletin contains information about 1 vulnerability.

1) Integer underflow (CVE-ID: CVE-2026-99182)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service by triggering an invalid shift during audio capture configuration.

The vulnerability exists due to integer underflow in the Linux kernel's sof_ipc4_prepare_copier_module() function in sound/soc/sof/ipc4-topology.c when configuring aggregated ALH capture streams. A local user can trigger configuration of a capture stream with fewer channels than aggregated devices, causing step to become zero and step - 1 to underflow to UINT_MAX, which produces an out-of-bounds shift in GENMASK() and may disrupt audio processing or system availability.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/5e1322787c5e424a570e87c8c2c25e37552cbe3b
• https://git.kernel.org/stable/c/746de48c3a250f0c264105dcbfcdf0c5001e970b
• https://git.kernel.org/stable/c/cad63a7798d6a6cac1fc68732595f0a3278ff6f0