CVE-2025-71286

Advisory lineage Upstream: 0 Downstream: 5
Analyzed
Published: 06 May 2026, 11:32
Last modified:11 May 2026, 21:57

Vulnerability Summary

Overall Risk (default)
low
22/100
CVSS Score
5.5 MEDIUM
v3.1 (nvd)
EPSS Score
0.13% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

06 May 2026, 11:32
Published
Vulnerability first disclosed
11 May 2026, 21:57
Last Modified
Vulnerability information updated

Description

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls The size of the data behind of scontrol->ipc_control_data for bytes controls is: [1] sizeof(struct sof_ipc4_control_data) + // kernel only struct [2] sizeof(struct sof_abi_hdr)) + payload The max_size specifies the size of [2] and it is coming from topology. Change the function to take this into account and allocate adequate amount of memory behind scontrol->ipc_control_data. With the change we will allocate [1] amount more memory to be able to hold the full size of data.

CVSS Metrics

  • v3.1•MEDIUM•Score: 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.13%• Percentile: 3%

Affected Systems

  • linux•linux

    ≥ a382082ff74b036944cbc5b6ad29b65f633acd3a, < 59fe643f21b9d59bcbedb0dfbf988ee455c23736 | ≥ a382082ff74b036944cbc5b6ad29b65f633acd3a, < 491956b45b5f4933632ea6d8a8bdfdf045ab81e1 | ≥ a382082ff74b036944cbc5b6ad29b65f633acd3a, < a704a1a4394b5877b9adc31b2c3165ad0b541896 | ≥ a382082ff74b036944cbc5b6ad29b65f633acd3a, < 1237cd9ff198cb882402572f29569e5247190974 | ≥ a382082ff74b036944cbc5b6ad29b65f633acd3a, < a653820700b81c9e6f05ac23b7969ecec1a18e85 | 6.4

  • linux•linux kernel

    ≥ 6.4, < 6.6.128 | ≥ 6.7, < 6.12.75 | ≥ 6.13, < 6.18.16 | ≥ 6.19, < 6.19.6

References (5)