Executive brief
The Linux kernel's TAS2562 audio codec driver contains a flaw in its volume control handler where user-supplied values are not validated before being used as array indices. An unprivileged local user with audio control access can trigger an out-of-bounds array read, potentially reading sensitive kernel memory or causing a system crash.
Technical details
The vulnerability is an array bounds check bypass in the tas2562_volume_control_put() function in sound/soc/codecs/tas2562.c. The function accepts a user-supplied integer control value without validation, divides it by two, and uses the result directly as an index into the fixed-size float_vol_db_lookup[] array. An attacker with local access and audio control privileges can supply an out-of-bounds index value to read or write arbitrary kernel memory at the location of the array. The patch adds bounds checking using ARRAY_SIZE() to ensure the calculated index remains within valid array bounds before any array access. Exploitation requires local access and the ability to manipulate audio controls (typically available to unprivileged users in modern audio systems).
Affected products
- Linux Linux kernel various (patched as of 2026-08-23)
Timeline
- 2026-08-26: disclosed
- 2026-08-23: patched