Out-of-bounds Shift Vulnerability in Linux Kernel Affects Audio Capture Functionality

CVE-2026-99182

What is CVE-2026-99182?

A vulnerability in the Linux kernel's audio subsystem, specifically within the ASoC SOF ipc4-topology component, leads to an out-of-bounds shift during the handling of aggregated ALH capture streams. This situation arises when the channel count is less than the configured device count, resulting in calculations that can produce a negative index, ultimately causing a shift-out-of-bounds condition. This flaw could potentially be exploited to disrupt audio functionality or lead to undefined behavior in the system.

References