In the Linux kernel, an integer overflow in the SOF ipc3 control update path allows a crafted firmware message to compute a small buffer size. This lets the size check in the driver pass while the actual data written exceeds the allocated buffer, causing an out-of-bounds access in the host audio driver. The flaw can corrupt kernel memory or trigger a crash. Based on this, it is inferred that a local user with the ability to load or influence firmware might potentially gain elevated privileges or destabilize the system.

All 32‑bit Linux kernel builds that support the ASoC SOF ipc3 control path are affected. The vulnerability is present until the patch is applied, affecting any machine that loads SOF firmware with an unbounded cdata->num_elems field.

Based on the description, exploitation would require kernel-level access to supply malicious firmware or modify the control update packet. A privileged local user could achieve this. The CVSS score is 7.8, indicating high severity. While the EPSS score is low at < 1% and the vulnerability is not listed in KEV, the kernel-level nature and potential for arbitrary memory corruption give this flaw a high risk, making immediate remediation essential.