All vulnerabilities
CVE-2026-93280

Linux: greybus: audio: bound the topology section sizes against the fetched size

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
8.8High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.32%Chance of exploitation activity in the next 30 days, higher than 23% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in6f764363b3173d805be11e59a8f23ecee2d420d5Also 52daf9de692ebac813d110eb1e677dc0e1f4a5ab, 33d8c7b794d2a30637c9d3fcb478f1d3222bef1eCVE List
Published24 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 6f764363b3173d805be11e59a8f23ecee2d420d5LinuxCVE List
  • 52daf9de692ebac813d110eb1e677dc0e1f4a5abLinuxCVE List
  • 33d8c7b794d2a30637c9d3fcb478f1d3222bef1eLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

greybus: audio: bound the topology section sizes against the fetched size

gb_audio_gb_get_topology() fetches a topology blob of a module-supplied size, and gbaudio_tplg_parse_data() then walks it by adding the module-supplied size_dais, size_controls and size_widgets fields to form the control, widget and route section offsets. Those le32 sizes are never checked against the fetched blob, so a module reporting a small topology size but large section sizes makes the offsets point past the allocation, and parsing reads out of bounds.

Reject a topology whose section sizes do not fit within the fetched size before it is parsed.

Text from CVE List

Affected versions 18

  • Linuxaffected: 184992e305f1de3a3d5fa446da3a2bc76be7c54a before ba86de9f7b0d7903d2df5ea2373e34d8ca3fc43eCVE List
  • Linuxaffected: 184992e305f1de3a3d5fa446da3a2bc76be7c54a before dd5593aee0a0fb353e1164aff7b65e563fe1f232CVE List
  • Linuxaffected: 184992e305f1de3a3d5fa446da3a2bc76be7c54a before 6f764363b3173d805be11e59a8f23ecee2d420d5CVE List
  • Linuxaffected: 184992e305f1de3a3d5fa446da3a2bc76be7c54a before 52daf9de692ebac813d110eb1e677dc0e1f4a5abCVE List
  • Linuxaffected: 184992e305f1de3a3d5fa446da3a2bc76be7c54a before d0f6eaba60705bacd9bb4ce48eab50ef3f546777CVE List
  • Linuxaffected: 184992e305f1de3a3d5fa446da3a2bc76be7c54a before c9191f2e2f35f1209eb2dc24b31129dd47b48c16CVE List
  • Linuxaffected: 184992e305f1de3a3d5fa446da3a2bc76be7c54a before cfcc5a41a9664eb68023aae4cd0d485b256bd7c7CVE List
  • Linuxaffected: 184992e305f1de3a3d5fa446da3a2bc76be7c54a before 33d8c7b794d2a30637c9d3fcb478f1d3222bef1eCVE List
  • Linuxaffected: 4.9CVE List
  • Linuxunaffected: all versions before 4.9CVE List
  • Linuxunaffected: 5.10.270 through 5.10.*CVE List
  • Linuxunaffected: 5.15.221 through 5.15.*CVE List
  • Linuxunaffected: 6.1.188 through 6.1.*CVE List
  • Linuxunaffected: 6.6.157 through 6.6.*CVE List
  • Linuxunaffected: 6.12.110 through 6.12.*CVE List
  • Linuxunaffected: 6.18.52 through 6.18.*CVE List
  • Linuxunaffected: 7.2.6 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8