CVE-2026-99182
NoneCVSS
—
EPSS
0.2%
Published
Oct 28, 2026
CISA due date
—
Cloudanix analysis
A Linux audio bug can crash systems when certain low-channel microphones are used across multiple connections.
- Exploitation
- Local Privilege
- Attacker needs
- Local User
- Complexity
- Moderate
- Impact
- Denial Of Service
- Component
- OS kernel
- Class
- Memory Corruption
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Integer truncation in channel count division produces zero step value, underflowing GENMASK argument and triggering out-of-bounds shift in ipc4-topology.c during ALH aggregated capture topology setup.
Why it matters to the business
Audio subsystem instability or crashes on Linux systems using SOF with mono or low-channel aggregated microphone streams, potentially affecting voice, conferencing, or recording workloads.
How an attack unfolds
An attacker supplies an audio topology blob describing an aggregated ALH capture stream where channel count is smaller than device count; the kernel division truncates to zero, the subsequent GENMASK underflows, and the invalid shift occurs during topology parsing.
How to fix it
Apply the upstream fix that treats ch_count < device_count identically to the equal-reference-channels case; rebuild and deploy updated kernel packages containing the corrected ipc4-topology logic.
How to confirm the fix worked
Boot with UBSAN enabled and confirm absence of the shift-out-of-bounds report at sound/soc/sof/ipc4-topology.c:2363 when exercising aggregated ALH capture streams with ch_count < device_count.
Typical attack path
- Create or supply topology configuration for mono capture across multiple aggregated SoundWire links
- Trigger SOF IPC4 topology parsing in the kernel
- Force ch_count < device_count condition leading to step truncation and GENMASK underflow
- Induce shift-out-of-bounds in sound/soc/sof/ipc4-topology.c
How to detect it
Search kernel logs and dmesg for UBSAN shift-out-of-bounds messages referencing sound/soc/sof/ipc4-topology.c during audio topology initialization.
- UBSAN: shift-out-of-bounds in sound/soc/sof/ipc4-topology.c:2363:13
- shift exponent 18446744069414584384 is too large for 64-bit type
What your security team should do
- Prioritize kernel updates containing the ASoC SOF topology fix
- Audit deployed systems for use of aggregated ALH/SmartMic capture configurations
- Add kernel UBSAN alerts mentioning ipc4-topology.c to monitoring rules
The record
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture When ch_count is smaller than blob->alh_cfg.device_count (e.g. a mono capture stream, such as a SmartMic, aggregated across multiple SDW links), step = ch_count / blob->alh_cfg.device_count truncates to 0. The subsequent GENMASK(step - 1, 0) then underflows step - 1 (u32) to UINT_MAX, causing GENMASK()'s internal shift to use an out-of-bounds exponent: UBSAN: shift-out-of-bounds in sound/soc/sof/ipc4-topology.c:2363:13 shift exponent 18446744069414584384 is too large for 64-bit type 'long unsigned int' Treat ch_count < device_count the same way as the existing "channels equal to output reference channels" case: apply the same ch_mask to every aggregated device instead of trying to split channels that can't be evenly divided.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|