CVE-2026-99182
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture When ch_count …
Impact
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture When ch_count is smaller than blob->alh_cfg.device_count (e.g. a mono capture stream, such as a SmartMic, aggregated across multiple SDW links), step = ch_count / blob->alh_cfg.device_count truncates to 0. The subsequent GENMASK(step - 1, 0) then underflows step - 1 (u32) to UINT_MAX, causing GENMASK()'s internal shift to use an out-of-bounds exponent: UBSAN: shift-out-of-bounds in sound/soc/sof/ipc4-topology.c:2363:13 shift exponent 18446744069414584384 is too large for 64-bit type 'long unsigned int' Treat ch_count < device_count the same way as the existing "channels equal to output reference channels" case: apply the same ch_mask to every aggregated device instead of trying to split channels that can't be evenly divided.
Affected packages
This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.
References
- NVD record
- CVE.org record
- https://git.kernel.org/stable/c/5e1322787c5e424a570e87c8c2c25e37552cbe3b
- https://git.kernel.org/stable/c/746de48c3a250f0c264105dcbfcdf0c5001e970b
- https://git.kernel.org/stable/c/a92dee3a2a5e1ef05d13731b2f5e2eb9a3125e4e
- https://git.kernel.org/stable/c/cad63a7798d6a6cac1fc68732595f0a3278ff6f0
- https://git.kernel.org/stable/c/ef9342fa7433643f54de19b980e2aac0fae7201c