{"id":"CVE-2026-99182","kind":"vulnerability","aliases":["CVE-2026-99182"],"related":[],"title":"Linux kernel: SOF audio topology shift error on aggregated mono capture","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture\n\nWhen ch_count is smaller than blob->alh_cfg.device_count (e.g. a mono\ncapture stream, such as a SmartMic, aggregated across multiple SDW\nlinks), step = ch_count / blob->alh_cfg.device_count truncates to 0.\nThe subsequent GENMASK(step - 1, 0) then underflows step - 1 (u32) to\nUINT_MAX, causing GENMASK()'s internal shift to use an out-of-bounds\nexponent:\n\n  UBSAN: shift-out-of-bounds in sound/soc/sof/ipc4-topology.c:2363:13\n  shift exponent 18446744069414584384 is too large for 64-bit type 'long unsigned int'\n\nTreat ch_count < device_count the same way as the existing \"channels\nequal to output reference channels\" case: apply the same ch_mask to\nevery aggregated device instead of trying to split channels that\ncan't be evenly divided.","summary":"In the Linux kernel's SOF audio topology code, a mono capture stream aggregated across multiple SoundWire links causes an out-of-bounds shift, which UBSAN reports. The sources describe a kernel undefined-behaviour bug and do not state an attacker outcome.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux-kernel","sof-audio","soundwire"],"not_affected_if":["no-sof-audio-hardware"],"how_to_check":"- unknown","fix":"- Update to a Linux kernel release that includes the upstream commit 'ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture'\n- unknown","status":"open","published_at":"2026-10-28T11:17:39+00:00","first_seen_at":"2026-10-28T11:32:36+00:00","triaged_at":"2026-10-28T11:35:23+00:00","updated_at":"2026-10-28T11:35:23+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-28T11:35:23Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release that includes the upstream commit 'ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture'\n- unknown","reach":"unknown","title":"Linux kernel: SOF audio topology shift error on aggregated mono capture","impact":"low","summary":"In the Linux kernel's SOF audio topology code, a mono capture stream aggregated across multiple SoundWire links causes an out-of-bounds shift, which UBSAN reports. The sources describe a kernel undefined-behaviour bug and do not state an attacker outcome.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","sof-audio","soundwire"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown","analyst_note":"Check the NVD entry and the upstream kernel commit for affected version ranges and whether an attacker can trigger the path.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-sof-audio-hardware"],"who_is_affected":"Systems running a Linux kernel with the SOF audio driver and aggregated ALH capture across multiple SoundWire links, such as laptops with multi-mic arrays. The sources do not say which kernel versions are affected or how an attacker would reach the code path.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000615,"input_tokens":3586,"output_tokens":513,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-99182':14A,17A '0':126C,132C '1':131C,136C '13':163C '18446744069414584384':166C '2363':162C '64':171C 'across':40B,114C 'aggreg':9A,39B,92C,113C,202C 'alh':93C 'alh_cfg.device':102C,122C 'appli':195C 'asoc':80C 'attack':68B 'audio':4A,24B,32B 'behaviour':61B 'bit':172C 'blob':101C,121C 'bound':49B,90C,152C,159C 'bug':62B 'captur':11A,37B,94C,107C 'case':194C 'caus':44B,141C 'ch':96C,119C,178C,198C 'channel':188C,193C,209C 'code':34B 'count':97C,103C,120C,123C,179C,181C 'cve':12A,15A 'describ':56B 'devic':180C,203C 'divid':215C 'e.g':104C 'equal':189C 'error':7A 'even':214C 'everi':201C 'exist':187C 'expon':153C,165C 'fix':85C 'follow':75C 'genmask':129C,142C 'infrastructur':18B 'instead':204C 'int':176C 'intern':144C 'ipc4':83C 'ipc4-topology':82C 'kernel':2A,21B,29B,58B,73C 'larg':169C 'link':43B,117C 'linux':1A,20B,28B,72C 'linux-kernel':19B 'long':174C 'mask':199C 'max':140C 'mono':10A,36B,106C 'multipl':41B,115C 'out-of-bound':46B,149C 'outcom':69B 'output':191C 'refer':192C 'report':53B 'resolv':79C 'sdw':116C 'shift':6A,50B,87C,145C,156C,164C 'shift-out-of-bound':86C,155C 'smaller':99C 'smartmic':112C 'sof':3A,23B,31B,81C 'sof-audio':22B 'sound/soc/sof/ipc4-topology.c':161C 'soundwir':25B,42B 'sourc':55B 'split':208C 'state':66B 'step':118C,130C,135C 'stream':38B,108C 'subsequ':128C 'topolog':5A,33B,84C 'treat':177C 'tri':206C 'truncat':124C 'type':173C 'u32':137C 'ubsan':52B,154C 'uint':139C 'undefin':60B 'undefined-behaviour':59B 'underflow':134C 'unsign':175C 'use':147C 'vulner':76C 'way':184C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the SOF audio driver and aggregated ALH capture across multiple SoundWire links, such as laptops with multi-mic arrays. The sources do not say which kernel versions are affected or how an attacker would reach the code path.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:39+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99182","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99182","severity":null,"published_at":"2026-10-28T11:17:39+00:00","modified_at":"2026-10-28T11:17:39+00:00","first_seen_at":"2026-10-28T11:32:36+00:00","fetched_at":"2026-10-28T11:32:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}