This bug in the Linux kernel’s ASoC SOF ipc3 control interface introduces a time‑of‑check to time‑of‑use race that can result in incorrect buffer copy lengths. In the bytes_put routine, the copy length is calculated from the existing buffer size instead of the incoming data’s size, potentially truncating valid data or copying stale bytes. The bytes_get routine similarly fails to adjust the size check for the control header offset, allowing reads that exceed allocated space. These issues can corrupt kernel memory during normal driver operation and may enable an attacker to alter kernel data structures.

All Linux kernel builds that include the ASoC SOF ipc3 driver before the TOCTOU fix are affected. The impact applies to any system running an unpatched kernel that supports the SOF audio subsystem. No specific kernel version range is cited, so users should verify whether their kernel contains the commit that introduces the size validation changes.

The CVSS score is 7.8, indicating high severity. The EPSS score is less than 1% and the vulnerability is not listed in CISA KEV, indicating a low current exploitation probability. The likely attack vector is local: an attacker with access to the SOF audio device can invoke ioctl calls that trigger the buggy copy operations. Exploitation could lead to uncontrolled kernel memory writes or reads, providing a pathway for privilege escalation or denial‑of‑service once the attacker can reach the vulnerable driver.