diff --git a/sound/soc/sof/ipc3-control.c b/sound/soc/sof/ipc3-control.c
index d1697401b1da0d..1b64145a3a3c0e 100644
--- a/sound/soc/sof/ipc3-control.c
+++ b/sound/soc/sof/ipc3-control.c
@@ -380,6 +380,7 @@ static int sof_ipc3_bytes_ext_put(struct snd_sof_control *scontrol,
 	struct sof_ipc_ctrl_data *cdata = scontrol->ipc_control_data;
 	struct snd_soc_component *scomp = scontrol->scomp;
 	struct snd_ctl_tlv header;
+	unsigned int payload;
 	int ret = -EINVAL;
 
 	/*
@@ -449,6 +450,15 @@ static int sof_ipc3_bytes_ext_put(struct snd_sof_control *scontrol,
 		goto err_restore;
 	}
 
+	/* header.length has been verified to be >= sizeof(struct sof_abi_hdr) */
+	payload = header.length - sizeof(struct sof_abi_hdr);
+	if (cdata->data->size > payload) {
+		dev_err_ratelimited(scomp->dev,
+				    "ABI header claims %u bytes of data, TLV carries %u\n",
+				    cdata->data->size, payload);
+		goto err_restore;
+	}
+
 	/* notify DSP of byte control updates */
 	if (pm_runtime_active(scomp->dev)) {
 		/* Actually send the data to the DSP; this is an opportunity to validate the data */