CVE-2026-72488

Source
https://cve.org/CVERecord?id=CVE-2026-72488
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-72488.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-72488
Downstream
BELL (1)
DEBIAN (1)
openSUSE (1)
SUSE (10)
UBUNTU (1)
Related
Published
2026-08-15T05:57:24Z
Modified
2026-10-27T17:27:18Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
soundwire: fix bug in sdw_add_element_group_count found by syzkaller
Details

In the Linux kernel, the following vulnerability has been resolved:

soundwire: fix bug in sdw_add_element_group_count found by syzkaller

The original implementation caused an out-of-bounds memory access in the sdw_add_element_group_count for-loop when i == num.

for (i = 0; i <= num; i++) { if (rate == group->rates[i] && lane == group->lanes[i]) ...

To fix this error, the function now checks for existing rate/lane entries in the group(a function parameter) using a for-loop before adding them.

No functional changes apart from this fix.

Database specific
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72488.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
9026118f20e28f202dab34f219bbb831ffb8c4dc
Fixed
a2275dce05e6d1cce69bf68f23ea7a63c0c54bae
Fixed
5c3ce6d3559ce57e6c3108aa9ecf7b32764188c5
Fixed
a454f61747c97e2eadaa7a35ffc1f4b1645c6a53
Fixed
e483a406a23a92d5202e8d324f206e127eef48ff
Fixed
f772ff5a0e6758fd412803c09e03ba3bca5f5878

Database specific

source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-72488.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.10.0
Fixed
6.6.160
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.114
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.40
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.1.5

Database specific

source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-72488.json"