---
id: CVE-2025-71286
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls

  The size of the data behind of scontrol->ipc_control_data for bytes
  controls is:
  [1] sizeof(st…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls

  The size of the data behind of scontrol->ipc_control_data for bytes
  controls is:
  [1] sizeof(st…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 6.4, < 6.6.128'
  - 'linux_kernel >= 6.7, < 6.12.75'
  - 'linux_kernel >= 6.13, < 6.18.16'
  - 'linux_kernel >= 6.19, < 6.19.6'
patched:
  - linux_kernel 6.19.6
published: '2026-05-06'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T13:10:00.187'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-71286'
references:
  - url: 'https://git.kernel.org/stable/c/1237cd9ff198cb882402572f29569e5247190974'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/491956b45b5f4933632ea6d8a8bdfdf045ab81e1'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/59fe643f21b9d59bcbedb0dfbf988ee455c23736'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a653820700b81c9e6f05ac23b7969ecec1a18e85'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a704a1a4394b5877b9adc31b2c3165ad0b541896'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
epss: 0.00138
epssPercentile: 0.02791
ingestedAt: '2026-10-14T13:30:58.486Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls

The size of the data behind of scontrol->ipc_control_data for bytes
controls is:
[1] sizeof(struct sof_ipc4_control_data) + // kernel only struct
[2] sizeof(struct sof_abi_hdr)) + payload

The max_size specifies the size of [2] and it is coming from topology.

Change the function to take this into account and allocate adequate amount
of memory behind scontrol->ipc_control_data.

With the change we will allocate [1] amount more memory to be able to hold
the full size of data.

## Affected

- `linux_kernel >= 6.4, < 6.6.128`
- `linux_kernel >= 6.7, < 6.12.75`
- `linux_kernel >= 6.13, < 6.18.16`
- `linux_kernel >= 6.19, < 6.19.6`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.19.6`