A malformed ASoC topology file contains a truncated vendor array; the SOF topology parser reads an array size before the vendor-array header is fully available. The loop condition only checks that some data remains, and a signed-to‑unsigned comparison flaw allows negative or zero sizes to escape the check. This can result in out-of-bounds memory accesses and kernel crashes, leading to a denial of service.

The vulnerability is present in the Linux kernel’s ASoC SOF topology parsing code. All kernel releases that include the SOF driver and have not yet been patched are affected. Users of mainstream distributions whose kernels lack the patch are at risk until they update. The CPE string identifies the target as linux_kernel.

The flaw operates in kernel space, so successful exploitation could cause a crash. The likely attack vector is local: an attacker must be able to supply a crafted topology file or otherwise influence the SOF driver’s parsing routine. The EPSS score is below 1%, indicating a low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog.