A heap overflow in the Linux kernel ASoC SOF ipc3-control module allows an unprivileged local user to write beyond the bounds of a kernel buffer used for control data. The bug resides in the bytes_ext_put and bytes_ext_get routines, where bounds checks mistakenly compare the user input length to the total allocation size instead of the payload area, enabling up to the size of the control structure past the intended buffer. This corruption can overwrite arbitrary kernel memory, potentially leading to privilege escalation, but the CVE description does not guarantee code execution; the impact is limited to memory corruption and privilege escalation. The complementary get routine also permits over‑reading of adjacent heap data.

The flaw is present in the Linux kernel ASoC SOF ipc3-control code. All kernel versions that have not incorporated the official fix are affected. The vulnerability is triggered through the ALSA TLV kcontrol interface on systems that have an ASoC SOF‑compatible audio controller. No vendor or product version list is supplied; any unpatched kernel with the relevant code will be susceptible.

The attack requires a local user process with access to the ALSA control interface and the ability to supply data to the vulnerable routines. The EPSS score is < 1% and the CVSS score is 7.8, indicating a low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker would likely abuse the TLV control path to corrupt kernel memory and elevate privileges on the affected system.