Look up another CVE · open CVE-2026-93280 in the interactive tracker
CVE-2026-93280
greybus: audio: bound the topology section sizes against the fetched size
Published 2026-09-24 (24 days ago) by the Linux kernel CNA. Subsystem drivers/staging. Debian urgency: not yet assigned.
Debian does not build this code. The per-release build detail is under "Where it lives" below.
What to do, per Debian release
Debian's own status for CVE-2026-93280 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4841-1 · 2026-10-17 · text | 6.1.190-1 | Update the kernel and reboot. DLA-4841-1 shipped the fix on 2026-10-17, in 6.1.190-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixedDSA-6528-1 · 2026-09-29 · text | 6.12.111-1 | Update the kernel and reboot. DSA-6528-1 shipped the fix on 2026-09-29, in 6.12.111-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4817-1 · 2026-10-04 · text | 6.12.111-1~deb12u1 | Update the kernel and reboot. DLA-4817-1 shipped the fix on 2026-10-04, in 6.12.111-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
gb_audio_gb_get_topology() fetches a topology blob of a module-supplied size, and gbaudio_tplg_parse_data() then walks it by adding the module-supplied size_dais, size_controls and size_widgets fields to form the control, widget and route section offsets. Those le32 sizes are never checked against the fetched blob, so a module reporting a small topology size but large section sizes makes the offsets point past the allocation, and parsing reads out of bounds. Reject a topology whose section sizes do not fit within the fetched size before it is parsed.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/staging/greybus/audio_gb.c
- What this is
- GREYBUS AUDIO PROTOCOLS DRIVERSMAINTAINERS section matched on drivers/staging/greybus/audio_gb.c · Maintained
- Kernel module
- none to look for. The file would have gone into gb_audio_gb, and Debian does not compile it into that module, so finding gb_audio_gb in lsmod would say nothing about this CVE.
Check it on the machine
grep -wE 'CONFIG_GREYBUS|CONFIG_GREYBUS_AUDIO|CONFIG_STAGING' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian does not build this code. In 5 releases below, every kernel flavour Debian publishes has the switch off, so the vulnerable file is compiled into no kernel binary Debian ships.
- bookworm, trixie, forky, sid, bookworm · linux-6.12n
- n
- not enabled on any flavour - this release does not build the code
- Build switches
- CONFIG_GREYBUS, CONFIG_GREYBUS_AUDIO, CONFIG_STAGING
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-09-24 (24 days ago)source
- CVSS
- 8.8 high
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- adjacent network (AV:A)source
- EPSS
- 0.32%, higher than 23.6% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/staging
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 4.9 | 5.10.270 | ba86de9f7b0d |
| 4.9 | 5.15.221 | dd5593aee0a0 |
| 4.9 | 6.1.188 | 6f764363b317 |
| 4.9 | 6.6.157 | 52daf9de692e |
| 4.9 | 6.12.110 | d0f6eaba6070 |
| 4.9 | 6.18.52 | c9191f2e2f35 |
| 4.9 | 7.2.6 | cfcc5a41a966 |
| 4.9 | 7.3 | 33d8c7b794d2 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4841-1 | 2026-10-17 | bookworm 6.1.190-1 | tracker |
| DLA-4817-1 | 2026-10-04 | bookworm 6.12.111-1~deb12u1 | tracker |
| DSA-6528-1 | 2026-09-29 | trixie 6.12.111-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:AAttack vector, adjacent network
- The malformed bytes are size_dais/size_controls/size_widgets in the GB_AUDIO_TYPE_GET_TOPOLOGY response that gb_audio_probe() fetches via gb_audio_gb_get_topology()→gb_operation_sync(); on BeaglePlay that Greybus payload is delivered by hdlc_rx_greybus_frame() from the CC1352 802.15.4 SVC, so a radio-range module supplies the blob, not a routable IP peer.
- AC:LAttack complexity, low
- A module that returns a small GET_TOPOLOGY_SIZE and then oversized le32 size_* fields makes gbaudio_tplg_process_header() compute control_offset/widget_offset past the kzalloc() blob on every gb_audio_probe(); the attacker fully controls those fields and no race or uninfluenced host state is required.
- PR:NPrivileges required, none
- The CNA published no note for this metric.
- UI:NUser interaction, none
- gb_audio_probe() itself calls gb_audio_gb_get_topology() and gbaudio_tplg_parse_data() as soon as a GREYBUS_CLASS_AUDIO bundle is registered; no victim ioctl, ALSA open, or mount is required.
- S:UScope, unchanged
- The over-read and snprintf() stores corrupt the host kernel topology allocation and adjacent slab inside the same kernel authority; this is not a KVM/Xen guest-to-host escape or an IOMMU/DMA bypass.
- C:HConfidentiality impact, high
- gbaudio_tplg_process_kcontrols() and gbaudio_tplg_create_widget() read gb_audio_control/widget fields from the OOB offset, and gb_generate_enum_strings() walks names with an unbounded while (*data != '\0') past the blob, disclosing adjacent kernel heap (and those strings can later appear as ALSA enum names).
- I:HIntegrity impact, high
- With curr/w pointing past the topology object, snprintf(curr->name, sizeof(curr->name), "GB %d %s", ...) in gbaudio_tplg_process_kcontrols() and snprintf(w->name, ...) in gbaudio_tplg_create_widget() perform 32-byte out-of-bounds writes at an attacker-chosen size_dais+size_controls offset, a heap write primitive.
- A:HAvailability impact, high
- Walking those OOB control/widget pointers and the unbounded enum-name scan can fault on an unmapped page during gb_audio_probe() and oops the kernel; the module can re-insert to repeat it.