---
id: CVE-2026-99182
title: 'ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture

  When ch_count is smaller than blob->alh_cfg.device_count (e.g. a mono
  capture stream, such…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 0390a102cc18cb7456d6c1f15ac51f1af90fcf9c <
    cad63a7798d6a6cac1fc68732595f0a3278ff6f0
  - >-
    Linux >= 0390a102cc18cb7456d6c1f15ac51f1af90fcf9c <
    5e1322787c5e424a570e87c8c2c25e37552cbe3b
  - >-
    Linux >= 0390a102cc18cb7456d6c1f15ac51f1af90fcf9c <
    746de48c3a250f0c264105dcbfcdf0c5001e970b
  - Linux 6.3
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T10:35:35.193Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99182'
references:
  - url: 'https://git.kernel.org/stable/c/cad63a7798d6a6cac1fc68732595f0a3278ff6f0'
  - url: 'https://git.kernel.org/stable/c/5e1322787c5e424a570e87c8c2c25e37552cbe3b'
  - url: 'https://git.kernel.org/stable/c/746de48c3a250f0c264105dcbfcdf0c5001e970b'
tags:
  - cve.org
ingestedAt: '2026-10-28T11:09:40.382Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture

When ch_count is smaller than blob->alh_cfg.device_count (e.g. a mono
capture stream, such as a SmartMic, aggregated across multiple SDW
links), step = ch_count / blob->alh_cfg.device_count truncates to 0.
The subsequent GENMASK(step - 1, 0) then underflows step - 1 (u32) to
UINT_MAX, causing GENMASK()'s internal shift to use an out-of-bounds
exponent:

  UBSAN: shift-out-of-bounds in sound/soc/sof/ipc4-topology.c:2363:13
  shift exponent 18446744069414584384 is too large for 64-bit type 'long unsigned int'

Treat ch_count < device_count the same way as the existing "channels
equal to output reference channels" case: apply the same ch_mask to
every aggregated device instead of trying to split channels that
can't be evenly divided.

## Affected

- `Linux >= 0390a102cc18cb7456d6c1f15ac51f1af90fcf9c < cad63a7798d6a6cac1fc68732595f0a3278ff6f0`
- `Linux >= 0390a102cc18cb7456d6c1f15ac51f1af90fcf9c < 5e1322787c5e424a570e87c8c2c25e37552cbe3b`
- `Linux >= 0390a102cc18cb7456d6c1f15ac51f1af90fcf9c < 746de48c3a250f0c264105dcbfcdf0c5001e970b`
- `Linux 6.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.