Executive brief
The Linux kernel's ASoC SDCA subsystem contains a flaw in how it validates UMP (Universal MIDI Packet) message sizes before processing them. When a message offset exceeds the buffer length, an arithmetic underflow allows invalid messages to pass validation, potentially leading to buffer overruns or information disclosure when audio messages are processed.
Technical details
The vulnerability is an integer underflow in the UMP message size validation logic within sound/soc/sdca/sdca_ump.c. The original check compared `msg_len > buf_len - msg_offset`, which can underflow when `msg_offset` is larger than `buf_len`, causing the comparison to pass incorrectly. The fix refactors this to `msg_offset + msg_len > buf_len`, which prevents the underflow. The vulnerability affects both the `sdca_ump_read_message()` and `sdca_ump_write_message()` functions. An attacker or malicious firmware could craft a message with an offset larger than the buffer to bypass the size check, potentially leading to out-of-bounds memory access. The patch was committed on 2026-07-23 and backported to stable kernel branches.
Affected products
- Linux Linux kernel versions prior to commit 556d872e7c2a0b570c5b0974813847ef0d0cd637
Timeline
- 2026-09-04: disclosed: CVE-2026-80900 published on NVD
- 2026-07-23: patched: Upstream commit 556d872e7c2a0b570c5b0974813847ef0d0cd637
- 2026-08-09: patched: Backported to stable kernels via commit fe5c53a952970ba15be8f512babd922e273579de