Description

In the Linux kernel, the following vulnerability has been resolved: greybus: audio: bound the topology section sizes against the fetched size gb_audio_gb_get_topology() fetches a topology blob of a module-supplied size, and gbaudio_tplg_parse_data() then walks it by adding the module-supplied size_dais, size_controls and size_widgets fields to form the control, widget and route section offsets. Those le32 sizes are never checked against the fetched blob, so a module reporting a small topology size but large section sizes makes the offsets point past the allocation, and parsing reads out of bounds. Reject a topology whose section sizes do not fit within the fetched size before it is parsed.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-24T16:17:25.290Z",
  "pubdate": "2026-09-24T16:17:25.290Z",
  "executiveSummary": "The Linux kernel Greybus audio subsystem contains an out-of-bounds read vulnerability due to improper input validation of topology blob structures.\nThe vulnerability arises when the gbaudio_tplg_parse_data function processes untrusted module-supplied section sizes without verifying them against the actual size of the fetched topology blob.\nAn attacker capable of supplying a malicious Greybus module can trigger an out-of-bounds memory read by crafting a topology blob with small overall sizes but inflated internal section offsets for DAIs, controls, and widgets.\nSuccessful exploitation allows an attacker to read arbitrary kernel memory, potentially leading to sensitive information disclosure or system instability through kernel crashes.\nThis vulnerability impacts the Linux kernel's Greybus audio framework, specifically within the topology parsing logic used during device initialization.\nThe attack requires the ability to interface with a Greybus-enabled system, typically requiring physical access or the ability to load a malicious hardware module.\nThe risk is high for embedded systems utilizing the Greybus protocol, as the lack of bounds checking compromises the integrity of kernel memory operations during the parsing phase.",
  "technicalDetails": "The vulnerability resides in the interaction between gb_audio_gb_get_topology() and gbaudio_tplg_parse_data() within the Linux kernel's Greybus audio subsystem.\nThe function gb_audio_gb_get_topology() is responsible for retrieving a topology blob from a connected module. The module specifies the size of this blob, which is then allocated in kernel memory.\nSubsequently, gbaudio_tplg_parse_data() processes this blob. The parser relies on internal fields provided by the module, specifically 'size_dais', 'size_controls', and 'size_widgets'.\nThese fields, defined as le32 types, are used to calculate offsets for the corresponding audio sections (control, widget, and route).\nThe root cause is a failure to perform bounds checking on these le32 values relative to the total size of the fetched blob. The kernel assumes the module-provided sizes are accurate and contained within the original memory allocation.\nIf a malicious module provides a small total topology size but large, crafted section size values, the calculated offsets for parsing these sections will point to memory addresses located outside the bounds of the allocated buffer.\nWhen the parser attempts to read from these calculated offsets, it performs an out-of-bounds (OOB) read. The processor accesses kernel memory that does not belong to the topology structure.\nAttack flow: 1. The attacker prepares a malicious Greybus hardware device that presents a crafted topology blob. 2. The kernel fetches this blob, trusting the module's declared size. 3. During parsing, the kernel uses the attacker-controlled section size fields to compute section offsets. 4. Due to the lack of validation, these offsets point to arbitrary kernel memory locations. 5. The parsing function attempts to process data from these invalid addresses. 6. The kernel either crashes due to memory access violations or returns sensitive kernel data to the audio configuration interface, allowing the attacker to leak memory contents.\nThis vulnerability exists in the parsing logic for Greybus audio topology data, which is reachable whenever a Greybus module is connected to the system. No specific user authentication is required, but the attacker must be able to interact with the Greybus bus to present the malformed blob to the subsystem."
}