CVE-2026-72488

HighCVSS 7.8/10Last modified Oct 21, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

soundwire: fix bug in sdw_add_element_group_count found by syzkaller

The original implementation caused an out-of-bounds memory access in the sdw_add_element_group_count for-loop when i == num.

for (i = 0; i <= num; i++) { if (rate == group->rates[i] && lane == group->lanes[i]) ...

To fix this error, the function now checks for existing rate/lane entries in the group(a function parameter) using a for-loop before adding them.

No functional changes apart from this fix.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Aug 15, 2026
Last modified
Oct 21, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-724898.4In the Linux kernel, the following vulnerability has been resolved: staging: nvec: fix use-after-free in nvec_rx_completed() In nvec_rx_coCVE-2026-72494.3The Location Weather plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the `splw_uCVE-2026-72490In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix stainfo check in rtw_aes_decrypt The null-poinCVE-2026-724919.8In the Linux kernel, the following vulnerability has been resolved: net/9p: fix race condition on rdma->state in trans_rdma.c The rdma->stCVE-2026-724928.8In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in same_client_has_lease() same_client_has_lCVE-2026-724939.9In the Linux kernel, the following vulnerability has been resolved: net: serialize netif_running() check in enqueue_to_backlog() Syzbot reCVE-2026-724949.8In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Replace waitqueue and flag with completion The driver prevCVE-2026-724959.3In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Avoid repeated requests to allocate WC pages ApplicationCVE-2026-724969.2In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Proper rollback if the ioremap fails bnxt_qplib_alloc_dpCVE-2026-724978.8In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Add a max slot check for SQ The variable WQE mode must bCVE-2026-72498In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Avoid displaying the kernel pointer While dumping the inCVE-2026-724998.8In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Free CQ toggle page after firmware teardown Free the tog
CVE-2026-72488: High severity, CVSS 7.8 | Vulnix