During control update handling in the ASoC SOF ipc4-control subsystem, the kernel does not verify the length of incoming MODULE_NOTIFICATION payloads before reading them. This omission means that a payload larger than the expected size could be read beyond the intended buffer boundary. The consequence is potentially undefined behavior that could compromise kernel stability.

Affected systems include any installations of the Linux kernel that incorporate the ASoC SOF ipc4-control subsystem. Since the patch is in the official kernel source, all kernels released before the inclusion of commit 5bdfeccb7fbf6e000fc783cd8412732e67c1ad0c are potentially vulnerable. No specific kernel version range is listed in the CVE data, but any kernel prior to this commit could be impacted.

The CVSS score of 7.8 indicates high severity, while the EPSS score of < 1% suggests a low probability of current exploitation. The vulnerability is not listed in the CISA KEV catalog, implying no known public exploits. Based on the description, it is inferred that the attack vector requires a local environment where an attacker can deliver a crafted MODULE_NOTIFICATION payload to the kernel module.