Executive brief
The Linux kernel's audio sound card driver for Amlogic Meson SoCs contains a flaw in HDMI and codec mux controls that fails to validate user-supplied enumeration values before processing them. An attacker with local access could provide out-of-range values to trigger buffer overflows or memory corruption, potentially leading to denial of service or privilege escalation.
Technical details
The vulnerability is an input validation bypass in the ASoC (ALSA System on Chip) Meson AIU driver's HDMI and internal codec mux put callbacks (aiu-codec-ctrl.c and aiu-acodec-ctrl.c). The code uses snd_soc_enum_item_to_val() to convert a user-supplied enumeration item value without first checking whether that value is within the valid range for the enumeration. An attacker with local access to the audio control interface can write out-of-range enum values that bypass bounds checking, leading to out-of-bounds array access or register corruption. The fix adds a simple bounds check (if (ucontrol->value.enumerated.item[0] >= e->items) return -EINVAL;) before the conversion, matching existing validation in related G12A codec controls. This is a kernel-level vulnerability requiring local access via audio control interfaces.
Affected products
- Linux Linux kernel versions with Meson AIU driver (affected in sound/soc/meson/aiu-codec-ctrl.c and sound/soc/meson/aiu-acodec-ctrl.c)
Timeline
- 2026-08-15: disclosed: Published on NVD
- 2026-06-09: patched: Upstream commit d65adf85477247be04ac86886f8edfaa047b5d4a by HyeongJun An
- 2026-07-24: patched: Backported to stable kernel by Sasha Levin (commit 0965892cc486ca554d72eeb62d85ccf8d0137a5a)