{"apiVersion":"1.0","identifier":"CVE-2026-72300","description":"In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: topology: validate vendor array size before parsing sof_parse_token_sets() reads array->size while iterating over topology private data. The loop condition only checks that some data remains, so a malformed topology with a truncated trailing vendor array can make the parser read the size field before a full vendor-array header is available. Validate that the remaining private data contains a complete snd_soc_tplg_vendor_array header before reading array->size. The declared array size check also needs to remain signed. asize is an int, but sizeof(*array) has type size_t, so comparing them directly promotes negative asize values to unsigned and lets them pass the check, as reported in the stable review thread reference below. Cast sizeof(*array) to int when validating the declared array size. This rejects negative, zero and otherwise too-small sizes before the parser dispatches to the tuple-specific code.","publishedAt":"2026-08-15T06:22:02","lastModifiedAt":"2026-08-17T06:18:32","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72300","cvssScore":null,"cvssVector":"Pending","epssProbability":0.002,"riskScore":0,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-72300","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-72300","en":"https://www.redsauce.net/en/cves/CVE-2026-72300","fr":"https://www.redsauce.net/fr/cves/CVE-2026-72300","pt":"https://www.redsauce.net/pt/cves/CVE-2026-72300","de":"https://www.redsauce.net/de/cves/CVE-2026-72300","sk":"https://www.redsauce.net/sk/cves/CVE-2026-72300","el":"https://www.redsauce.net/el/cves/CVE-2026-72300"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-72300"}}