CVE-2026-90196

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: validate topology volume range before allocation SOF treats the topology mixer min and max values as non-negative indices into its volume table. It stores them in signed fields, allocates max + 1 entries through an int argument, and later indexes the table with the stored range. An inverted range is invalid, while a maximum at or above INT_MAX cannot be represented safely after the increment or in the signed fields. Validate the complete range before storing it or allocating the table.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Published

2026-09-17 17:17:14.400000

Last modified

2026-10-19 09:19:09.600000

View original CVE JSON

{
  "id": "CVE-2026-90196",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2026-09-17T17:17:14.400",
  "lastModified": "2026-10-19T09:19:09.600",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: validate topology volume range before allocation\n\nSOF treats the topology mixer min and max values as non-negative indices\ninto its volume table. It stores them in signed fields, allocates max + 1\nentries through an int argument, and later indexes the table with the\nstored range.\n\nAn inverted range is invalid, while a maximum at or above INT_MAX cannot\nbe represented safely after the increment or in the signed fields.\nValidate the complete range before storing it or allocating the table."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "sound/soc/sof/topology.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "311ce4fe7637d96608b6e57bf9ebbd8aabcf429e",
              "lessThan": "992e130b888699d18da901b593d7a0fb75041a03",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "311ce4fe7637d96608b6e57bf9ebbd8aabcf429e",
              "lessThan": "cd63a1eb677e9548ba2d512be5dac4cb474ae145",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "311ce4fe7637d96608b6e57bf9ebbd8aabcf429e",
              "lessThan": "8e1d63f5e272061208455b5aa4cc0d5bcbe5c1a8",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "311ce4fe7637d96608b6e57bf9ebbd8aabcf429e",
              "lessThan": "d2f41287b51a3261d447ae38000f7a6f5860663a",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "311ce4fe7637d96608b6e57bf9ebbd8aabcf429e",
              "lessThan": "72d0b77412aef2cec554cc84e176658f2a48dafa",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "311ce4fe7637d96608b6e57bf9ebbd8aabcf429e",
              "lessThan": "a698e4a60fa54268a38f4e66378851a196cb139b",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "sound/soc/sof/topology.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "5.2",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "5.2",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.1.188",
              "lessThanOrEqual": "6.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.6.157",
              "lessThanOrEqual": "6.6.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.110",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18.52",
              "lessThanOrEqual": "6.18.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.2.6",
              "lessThanOrEqual": "7.2.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.3",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/72d0b77412aef2cec554cc84e176658f2a48dafa",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/8e1d63f5e272061208455b5aa4cc0d5bcbe5c1a8",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/992e130b888699d18da901b593d7a0fb75041a03",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a698e4a60fa54268a38f4e66378851a196cb139b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/cd63a1eb677e9548ba2d512be5dac4cb474ae145",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d2f41287b51a3261d447ae38000f7a6f5860663a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}