In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: topology: validate vendor array size before parsing sof_parse_token_sets() reads array->size while iterating over topology private data. The loop condition only checks that some data remains, so a malformed topology with a truncated trailing vendor array can make the parser read the size field before a full vendor-array header is available. Validate that the remaining private data contains a complete snd_soc_tplg_vendor_array header before reading array->size. The declared array size check also needs to remain signed. asize is an int, but sizeof(*array) has type size_t, so comparing them directly promotes negative asize values to unsigned and lets them pass the check, as reported in the stable review thread reference below. Cast sizeof(*array) to int when validating the declared array size. This rejects negative, zero and otherwise too-small sizes before the parser dispatches to the tuple-specific code.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ASoC: SOF: topology: validate vendor array size before parsing sof_parse_token_sets() reads array->size     while iterating over topology private data. The loop condition only checks that some data remains, so a     malformed topology with a truncated trailing vendor array can make the parser read the size field before a     full vendor-array header is available. Validate that the remaining private data contains a complete     snd_soc_tplg_vendor_array header before reading array->size. The declared array size check also needs to     remain signed. asize is an int, but sizeof(*array) has type size_t, so comparing them directly promotes     negative asize values to unsigned and lets them pass the check, as reported in the stable review thread     reference below. Cast sizeof(*array) to int when validating the declared array size. This rejects     negative, zero and otherwise too-small sizes before the parser dispatches to the tuple-specific code.
    (CVE-2026-72300)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update of the linux package has been released.

ID	Name	Product	Family	Type	Severity
365768	Ubuntu 26.04 LTS : Linux kernel (Azure) vulnerabilities (USN-8888-1)	Nessus	Ubuntu Local Security Checks	Local	medium
365767	Ubuntu 26.04 LTS : Linux kernel vulnerabilities (USN-8887-1)	Nessus	Ubuntu Local Security Checks	Local	medium
365525	Ubuntu 24.04 LTS : Linux kernel (Azure) vulnerabilities (USN-8918-1)	Nessus	Ubuntu Local Security Checks	Local	medium
365522	Ubuntu 24.04 LTS : Linux kernel vulnerabilities (USN-8917-1)	Nessus	Ubuntu Local Security Checks	Local	medium
365463	Ubuntu 26.04 LTS : Linux kernel (OEM) vulnerabilities (USN-8889-1)	Nessus	Ubuntu Local Security Checks	Local	medium
343049	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500248)	Nessus	Oracle Linux Local Security Checks	Local	high
337397	Linux Distros Unpatched Vulnerability : CVE-2026-72300	Nessus	Misc.	Local	medium
334784	Photon OS 5.0: Linux PHSA-2026-5.0-92-0952	Nessus	PhotonOS Local Security Checks	Local	high

Detections

Analytics

CVE-2026-72300

high

Tenable Plugins

medium

medium

medium

medium

medium

high

medium

high