185 lines
8.8 KiB
JSON
185 lines
8.8 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-99182",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2026-09-25T10:25:14.399Z",
|
|
"datePublished": "2026-10-28T10:35:35.193Z",
|
|
"dateUpdated": "2026-10-30T12:42:45.813Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-10-30T12:42:45.813Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture\n\nWhen ch_count is smaller than blob->alh_cfg.device_count (e.g. a mono\ncapture stream, such as a SmartMic, aggregated across multiple SDW\nlinks), step = ch_count / blob->alh_cfg.device_count truncates to 0.\nThe subsequent GENMASK(step - 1, 0) then underflows step - 1 (u32) to\nUINT_MAX, causing GENMASK()'s internal shift to use an out-of-bounds\nexponent:\n\n UBSAN: shift-out-of-bounds in sound/soc/sof/ipc4-topology.c:2363:13\n shift exponent 18446744069414584384 is too large for 64-bit type 'long unsigned int'\n\nTreat ch_count < device_count the same way as the existing \"channels\nequal to output reference channels\" case: apply the same ch_mask to\nevery aggregated device instead of trying to split channels that\ncan't be evenly divided."
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"sound/soc/sof/ipc4-topology.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "0390a102cc18cb7456d6c1f15ac51f1af90fcf9c",
|
|
"lessThan": "ef9342fa7433643f54de19b980e2aac0fae7201c",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "0390a102cc18cb7456d6c1f15ac51f1af90fcf9c",
|
|
"lessThan": "a92dee3a2a5e1ef05d13731b2f5e2eb9a3125e4e",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "0390a102cc18cb7456d6c1f15ac51f1af90fcf9c",
|
|
"lessThan": "cad63a7798d6a6cac1fc68732595f0a3278ff6f0",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "0390a102cc18cb7456d6c1f15ac51f1af90fcf9c",
|
|
"lessThan": "5e1322787c5e424a570e87c8c2c25e37552cbe3b",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "0390a102cc18cb7456d6c1f15ac51f1af90fcf9c",
|
|
"lessThan": "746de48c3a250f0c264105dcbfcdf0c5001e970b",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"sound/soc/sof/ipc4-topology.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "6.3",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "6.3",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.161",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.115",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18.59",
|
|
"lessThanOrEqual": "6.18.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.2.13",
|
|
"lessThanOrEqual": "7.2.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.3",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.3",
|
|
"versionEndExcluding": "6.6.161"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.3",
|
|
"versionEndExcluding": "6.12.115"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.3",
|
|
"versionEndExcluding": "6.18.59"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.3",
|
|
"versionEndExcluding": "7.2.13"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.3",
|
|
"versionEndExcluding": "7.3"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/ef9342fa7433643f54de19b980e2aac0fae7201c"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/a92dee3a2a5e1ef05d13731b2f5e2eb9a3125e4e"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/cad63a7798d6a6cac1fc68732595f0a3278ff6f0"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/5e1322787c5e424a570e87c8c2c25e37552cbe3b"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/746de48c3a250f0c264105dcbfcdf0c5001e970b"
|
|
}
|
|
],
|
|
"title": "ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |