Executive brief
The Linux kernel's audio subsystem (ASoC) contains a bounds-checking error in the DAPM (Digital Audio Mixer) enumeration handler. An attacker with local access could write out-of-bounds values to audio control enumerations, potentially reading kernel memory or triggering undefined behavior. This affects audio mixer operations on systems with certain sound cards (notably Analog Devices codecs).
Technical details
The vulnerability is an off-by-one boundary check in snd_soc_dapm_put_enum_double() in sound/soc/soc-dapm.c. The function validates item[0] against e->items but allows item[1] to equal e->items (instead of rejecting it when >= e->items). Since item[1] is then used as an index into e->values array without bounds checking in snd_soc_enum_item_to_val(), writing three into certain dual-channel enum controls (such as adav80x mixer values) reads one element past the end of the array. The vulnerability requires local access to write to audio control mixer values and is only caught by the kernel under CONFIG_SND_CTL_INPUT_VALIDATION (disabled by default). The fix changes the comparison from > to >= on line 3614/3549 of soc-dapm.c.
Affected products
- Linux Linux kernel all versions prior to patch commit 14511c9b54ceeeef487409d73947c89ee8563590
Timeline
- 2026-09-17: disclosed
- 2026-08-26: patched