CVE-2026-93280

Overview

CVE-2026-93280 is a high‑severity out‑of‑bounds read in the Linux kernel’s Greybus audio topology parsing. The flaw allows a malicious module to supply a topology blob with mismatched section sizes, causing the kernel to read beyond the allocated buffer. This can lead to information disclosure or kernel crashes.

Description

In the Linux kernel, the following vulnerability has been resolved: greybus: audio: bound the topology section sizes against the fetched size gb_audio_gb_get_topology() fetches a topology blob of a module-supplied size, and gbaudio_tplg_parse_data() then walks it by adding the module-supplied size_dais, size_controls and size_widgets fields to form the control, widget and route section offsets. Those le32 sizes are never checked against the fetched blob, so a module reporting a small topology size but large section sizes makes the offsets point past the allocation, and parsing reads out of bounds. Reject a topology whose section sizes do not fit within the fetched size before it is parsed.

Impact

The vulnerability permits an attacker to read arbitrary kernel memory, potentially exposing sensitive data or triggering a kernel panic. Defenders are impacted if their systems load untrusted Greybus audio modules. The attack compromises confidentiality, integrity, and availability of the host.

Remediation

Apply the latest kernel patch that bounds topology section sizes before parsing. If patching is not immediately possible, disable loading of Greybus audio modules or restrict module loading to trusted sources. Verify that the kernel version is at least the one containing the fix.

Risk context

Severity is high with CVSS 7.1. No EPSS data available. The issue remains unpatched in many current distributions, so the risk is moderate to high for systems that load Greybus audio modules.

Affected products

• Linux kernel
• Greybus audio driver