A heap overflow in the Linux kernel ASoC SOF ipc3-control module allows an unprivileged local user to write beyond the bounds of a kernel buffer allocated for ACP control data. The device driver uses the ALSA TLV kcontrol interface, which provides a write entry point to the vulnerable bytes_ext_put routine; the bounds check mistakenly compares the input length to the total allocation size instead of the payload area, allowing up to the size of the control structure past the allocated memory. This overflow can corrupt arbitrary kernel memory, potentially enabling code execution or crash of the kernel, and the complementary get routine allows over‑reading of adjacent heap data. The vulnerability exposes full kernel memory and has the potential to be leveraged for privilege escalation.

The flaw exists in the Linux kernel, affecting all versions where the ASoC SOF ipc3-control code has not yet been patched. The issue is triggered through the ALSA TLV kcontrol interface on systems configured with a compatible ASoC hardware controller. No specific vendor or product version list is supplied; any unpatched kernel will be susceptible.

Because the vulnerability requires only a local user process with access to the ALSA control interface and can overwrite kernel memory, the exploitation risk is high. No EPSS score is available and the issue is not listed in the CISA KEV catalog, but the nature of a heap overflow with control over data placement makes it a serious local privilege escalation vector. The attack is likely to be carried out by abusing the TLV control path to inject code or data into the kernel.