Executive brief
The Linux kernel's audio codec driver for Qualcomm LPASS transmit macro incorrectly accesses audio control settings, causing buffer overflows on 64-bit systems with debug enabled. This can make audio controls non-functional and potentially allow local attackers to cause system crashes or gain unauthorized access to the audio subsystem.
Technical details
The vulnerability is a buffer over-read/over-write in the tx_macro_dec_mode_get() and tx_macro_dec_mode_put() functions within sound/soc/codecs/lpass-tx-macro.c. These functions incorrectly access enumerated control values through ucontrol->value.integer.value[0] (a long, 8 bytes) instead of ucontrol->value.enumerated.item[0] (an unsigned int, 4 bytes), causing 4 bytes of out-of-bounds access. On 64-bit kernels with CONFIG_SND_CTL_DEBUG enabled, the sanity check detects this overflow and returns -EINVAL, breaking audio control functionality. The fix changes both functions to use the correct enumerated accessor. Exploitation requires local access and the ability to interact with audio controls; the impact is primarily denial of service (audio controls fail) though potential information disclosure or privilege escalation may be possible on vulnerable configurations.
Affected products
- Linux Linux Kernel affected versions prior to commit 1ba381759e45d5d0442452cfa5c42e836191a568
Timeline
- 2026-08-26: disclosed: CVE-2026-80583 published
- 2026-08-01: patched: Fix committed to mainline Linux kernel (commit 1ba381759e45d5d0442452cfa5c42e836191a568)