CVE-2026-99182

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99182", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.399Z", "datePublished": "2026-10-28T10:35:35.193Z", "dateUpdated": "2026-10-30T12:42:45.813Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:42:45.813Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture\n\nWhen ch_count is smaller than blob->alh_cfg.device_count (e.g. a mono\ncapture stream, such as a SmartMic, aggregated across multiple SDW\nlinks), step = ch_count / blob->alh_cfg.device_count truncates to 0.\nThe subsequent GENMASK(step - 1, 0) then underflows step - 1 (u32) to\nUINT_MAX, causing GENMASK()'s internal shift to use an out-of-bounds\nexponent:\n\n UBSAN: shift-out-of-bounds in sound/soc/sof/ipc4-topology.c:2363:13\n shift exponent 18446744069414584384 is too large for 64-bit type 'long unsigned int'\n\nTreat ch_count < device_count the same way as the existing \"channels\nequal to output reference channels\" case: apply the same ch_mask to\nevery aggregated device instead of trying to split channels that\ncan't be evenly divided."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/soc/sof/ipc4-topology.c"], "versions": [{"version": "0390a102cc18cb7456d6c1f15ac51f1af90fcf9c", "lessThan": "ef9342fa7433643f54de19b980e2aac0fae7201c", "status": "affected", "versionType": "git"}, {"version": "0390a102cc18cb7456d6c1f15ac51f1af90fcf9c", "lessThan": "a92dee3a2a5e1ef05d13731b2f5e2eb9a3125e4e", "status": "affected", "versionType": "git"}, {"version": "0390a102cc18cb7456d6c1f15ac51f1af90fcf9c", "lessThan": "cad63a7798d6a6cac1fc68732595f0a3278ff6f0", "status": "affected", "versionType": "git"}, {"version": "0390a102cc18cb7456d6c1f15ac51f1af90fcf9c", "lessThan": "5e1322787c5e424a570e87c8c2c25e37552cbe3b", "status": "affected", "versionType": "git"}, {"version": "0390a102cc18cb7456d6c1f15ac51f1af90fcf9c", "lessThan": "746de48c3a250f0c264105dcbfcdf0c5001e970b", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/soc/sof/ipc4-topology.c"], "versions": [{"version": "6.3", "status": "affected"}, {"version": "0", "lessThan": "6.3", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.161", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.115", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.59", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.13", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.6.161"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.12.115"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.18.59"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "7.2.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ef9342fa7433643f54de19b980e2aac0fae7201c"}, {"url": "https://git.kernel.org/stable/c/a92dee3a2a5e1ef05d13731b2f5e2eb9a3125e4e"}, {"url": "https://git.kernel.org/stable/c/cad63a7798d6a6cac1fc68732595f0a3278ff6f0"}, {"url": "https://git.kernel.org/stable/c/5e1322787c5e424a570e87c8c2c25e37552cbe3b"}, {"url": "https://git.kernel.org/stable/c/746de48c3a250f0c264105dcbfcdf0c5001e970b"}], "title": "ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["sound/soc/sof/ipc4-topology.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ef9342fa7433643f54de19b980e2aac0fae7201c", "status": "affected", "version": "0390a102cc18cb7456d6c1f15ac51f1af90fcf9c", "versionType": "git"}, {"lessThan": "a92dee3a2a5e1ef05d13731b2f5e2eb9a3125e4e", "status": "affected", "version": "0390a102cc18cb7456d6c1f15ac51f1af90fcf9c", "versionType": "git"}, {"lessThan": "cad63a7798d6a6cac1fc68732595f0a3278ff6f0", "status": "affected", "version": "0390a102cc18cb7456d6c1f15ac51f1af90fcf9c", "versionType": "git"}, {"lessThan": "5e1322787c5e424a570e87c8c2c25e37552cbe3b", "status": "affected", "version": "0390a102cc18cb7456d6c1f15ac51f1af90fcf9c", "versionType": "git"}, {"lessThan": "746de48c3a250f0c264105dcbfcdf0c5001e970b", "status": "affected", "version": "0390a102cc18cb7456d6c1f15ac51f1af90fcf9c", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["sound/soc/sof/ipc4-topology.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.3"}, {"lessThan": "6.3", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.161", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.115", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.59", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.13", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture\n\nWhen ch_count is smaller than blob->alh_cfg.device_count (e.g. a mono\ncapture stream, such as a SmartMic, aggregated across multiple SDW\nlinks), step = ch_count / blob->alh_cfg.device_count truncates to 0.\nThe subsequent GENMASK(step - 1, 0) then underflows step - 1 (u32) to\nUINT_MAX, causing GENMASK()'s internal shift to use an out-of-bounds\nexponent:\n\n UBSAN: shift-out-of-bounds in sound/soc/sof/ipc4-topology.c:2363:13\n shift exponent 18446744069414584384 is too large for 64-bit type 'long unsigned int'\n\nTreat ch_count < device_count the same way as the existing \"channels\nequal to output reference channels\" case: apply the same ch_mask to\nevery aggregated device instead of trying to split channels that\ncan't be evenly divided."}], "id": "CVE-2026-99182", "lastModified": "2026-10-30T13:21:51.913", "metrics": {}, "published": "2026-10-28T11:17:39.003", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5e1322787c5e424a570e87c8c2c25e37552cbe3b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/746de48c3a250f0c264105dcbfcdf0c5001e970b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a92dee3a2a5e1ef05d13731b2f5e2eb9a3125e4e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cad63a7798d6a6cac1fc68732595f0a3278ff6f0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ef9342fa7433643f54de19b980e2aac0fae7201c"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture", "id": "2562765", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562765"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-1335", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture\nWhen ch_count is smaller than blob->alh_cfg.device_count (e.g. a mono\ncapture stream, such as a SmartMic, aggregated across multiple SDW\nlinks), step = ch_count / blob->alh_cfg.device_count truncates to 0.\nThe subsequent GENMASK(step - 1, 0) then underflows step - 1 (u32) to\nUINT_MAX, causing GENMASK()'s internal shift to use an out-of-bounds\nexponent:\nUBSAN: shift-out-of-bounds in sound/soc/sof/ipc4-topology.c:2363:13\nshift exponent 18446744069414584384 is too large for 64-bit type 'long unsigned int'\nTreat ch_count < device_count the same way as the existing \"channels\nequal to output reference channels\" case: apply the same ch_mask to\nevery aggregated device instead of trying to split channels that\ncan't be evenly divided.", "A flaw was found in the Linux kernel's Sound Open Firmware (SOF) audio subsystem. When handling aggregated audio capture configurations where the channel count is smaller than the number of aggregated devices, an integer underflow occurs in the IPC4 topology driver. A local user could trigger this condition by configuring a specific audio stream, causing an out-of-bounds bit shift that leads to a kernel crash and a Denial of Service (DoS)."], "name": "CVE-2026-99182", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99182\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99182\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99182.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0390a102cc18cb7456d6c1f15ac51f1af90fcf9c,cad63a7798d6a6cac1fc68732595f0a3278ff6f0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0390a102cc18cb7456d6c1f15ac51f1af90fcf9c,5e1322787c5e424a570e87c8c2c25e37552cbe3b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0390a102cc18cb7456d6c1f15ac51f1af90fcf9c,746de48c3a250f0c264105dcbfcdf0c5001e970b)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.3"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.3)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.59,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.13,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0390a102cc18cb7456d6c1f15ac51f1af90fcf9c,cad63a7798d6a6cac1fc68732595f0a3278ff6f0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0390a102cc18cb7456d6c1f15ac51f1af90fcf9c,5e1322787c5e424a570e87c8c2c25e37552cbe3b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0390a102cc18cb7456d6c1f15ac51f1af90fcf9c,746de48c3a250f0c264105dcbfcdf0c5001e970b)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.3"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.3)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.59,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.13,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-28T12:00:22.510060+00:00", "updated": "2026-10-29T18:30:14.438166+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}