CVE-2025-71286: linux Incorrect Calculation of Buffer Size

Vulnerability summary

CVE-2025-71286 is a high (CVSS 7.8) Incorrect Calculation of Buffer Size vulnerability in linux. EPSS estimates a 0.14% chance of exploitation in the next 30 days, higher than 2.8% of scored vulnerabilities.

Timeline

1. 06-05-2026
   PublishedVulnerability first disclosed.
2. 19-10-2026
   Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls The size of the data behind of scontrol->ipc_control_data for bytes controls is: [1] sizeof(struct sof_ipc4_control_data) + // kernel only struct [2] sizeof(struct sof_abi_hdr)) + payload The max_size specifies the size of [2] and it is coming from topology. Change the function to take this into account and allocate adequate amount of memory behind scontrol->ipc_control_data. With the change we will allocate [1] amount more memory to be able to hold the full size of data.

• CWE-131Incorrect Calculation of Buffer SizeThe product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.