Live › vulnerability › CVE-2026-99182
Go to dashboardIn the Linux kernel's SOF audio topology code, a mono capture stream aggregated across multiple SoundWire links causes an out-of-bounds shift, which UBSAN reports. The sources describe a kernel undefined-behaviour bug and do not state an attacker outcome.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 11:32 UTC. All times on this page are UTC.
Systems running a Linux kernel with the SOF audio driver and aggregated ALH capture across multiple SoundWire links, such as laptops with multi-mic arrays. The sources do not say which kernel versions are affected or how an attacker would reach the code path.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture
When ch_count is smaller than blob->alh_cfg.device_count (e.g. a mono capture stream, such as a SmartMic, aggregated across multiple SDW links), step = ch_count / blob->alh_cfg.device_count truncates to 0. The subsequent GENMASK(step - 1, 0) then underflows step - 1 (u32) to UINT_MAX, causing GENMASK()'s internal shift to use an out-of-bounds exponent:
UBSAN: shift-out-of-bounds in sound/soc/sof/ipc4-topology.c:2363:13 shift exponent 18446744069414584384 is too large for 64-bit type 'long unsigned int'
Treat ch_count < device_count the same way as the existing "channels equal to output reference channels" case: apply the same ch_mask to every aggregated device instead of trying to split channels that can't be evenly divided.
This page as .md · .json · in your agent: get_signal("CVE-2026-99182")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.