Executive brief
The Linux kernel's FSL Audio Mixer driver contains a vulnerability in audio control parameter handling. User-supplied enumeration values were being used before validation, allowing malicious or malformed input to trigger out-of-bounds array access or incorrect hardware register manipulation. This could lead to kernel crashes or unexpected audio device behavior.
Technical details
The vulnerability exists in two functions in sound/soc/fsl/fsl_audmix.c: fsl_audmix_put_mix_clk_src() and fsl_audmix_put_out_src(). These functions accept user-provided enum item indices and convert them using snd_soc_enum_item_to_val() before validating whether the index is within the enum's item count. The clock-source path then uses the converted value with BIT() macro, and the output-source path indexes a transition table with it, both before bounds checking. An attacker with access to audio control APIs can supply out-of-range enum item values, causing array out-of-bounds access or unintended hardware register writes. The fix validates the enum item index against the items count before any conversion or use.
Affected products
- Linux Linux kernel kernel versions with ASoC FSL audmix driver (approximately 4.0 and later)
Timeline
- 2026-08-15: disclosed
- 2026-06-09: patched: Upstream fix commit 3cd17e4e2871114d5579fa7bc8da66faf7fc1930