In the Linux kernel greybus audio subsystem a calculated topology blob can be parsed without first verifying that the declared section sizes fit within the fetched data. An audio driver that claims a small topology size but supplies large values for the widget, control and route sections will lead the parser to compute offsets that lie outside the allocated buffer. This out‑of‑bounds read can expose kernel memory contents, potentially leaking sensitive data, or cause a kernel crash if the read path triggers a fault, resulting in a denial of service. The weakness resides in improper bounds checking (CWE‑125).

All Linux kernel builds that include the greybus audio driver before the patch commit that added a guard against oversized topology sections are affected. No specific kernel release numbers are provided, but any system that has not applied the kernel update containing the topology size validation is vulnerable. The flaw is limited to kernel modules that load the Greybus audio driver and therefore is not automatically exposed to non‑kernel processes.

The CVSS score for this vulnerability is 8.8, indicating a high severity of potential impact. The EPSS score is 0.00321, indicating a very low but nonzero probability of exploitation, and the flaw is not listed in the CISA KEV catalog. An attacker would need the ability to introduce or influence a Greybus audio module – for example, by loading a malicious driver or by compromising a device that supplies topology data over the Greybus interface. This scenario typically requires privileged or local access, making the attack vector likely to be 'local, privileged kernel module execution'. If successfully exploited, the attacker could crash the kernel or read arbitrary memory, leading to system instability or information disclosure.