CVE-2026-72262

In the Linux kernel, the following vulnerability has been resolved:

ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get

The ipccontroldata buffer is allocated as kzalloc(maxsize), where maxsize covers the entire struct sofipcctrldata including its flexible array payload. However, the bounds checks in bytesextput and bytesextget compared user data lengths against maxsize directly, ignoring that cdata->data sits at an offset of sizeof(struct sofipcctrldata) bytes into the allocation.

This allowed writing up to sizeof(struct sofipcctrl_data) bytes past the end of the heap buffer from unprivileged userspace via the ALSA TLV kcontrol interface, and similarly allowed over-reading adjacent heap data on the get path.

Fix all bounds checks to subtract sizeof(*cdata) from maxsize so they reflect the actual space available at the cdata->data offset. Also fix the error-path restore in bytesext_put which wrote to cdata->data instead of cdata, causing the same overflow.