HIGH Introduced in 5.12
asoc DecMode OOB
CVE-2026-80583
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI4.4MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses The "DEC0 MODE" to "DEC7 MODE" controls are enumerated, but tx_macro_dec_mode_get() and tx_macro_dec_mode_put() access their value through ucontrol->value.integer.value[0] (a long) instead of ucontrol->value.enumerated.item[0] (an unsigned int). This same pattern was fixed in the sibling drivers by commit bcfe5f76cc40 ("ASoC: codecs: rx-macro: fix accessing array out of bounds for enum type") and commit 0ea5eff7c606 ("ASoC: codecs: va-macro: fix accessing array out of bounds for enum type"), but tx-macro was missed. On 64-bit kernels built with CONFIG_SND_CTL_DEBUG, the elem value sanity check catches the 4 bytes written past the enumerated item and every read of these controls fails with -EINVAL: snd-sm8250 sound: control 2:0:0:DEC0 MODE:0: access overflow
02KernelScan AI Analysis
Risk summary
A local user with access to the ALSA audio control interface on a system using the Qualcomm LPASS TX macro codec can trigger an out-of-bounds write by accessing the DEC0–DEC7 MODE enumerated controls. On debug-enabled kernels this causes all reads of those controls to fail with -EINVAL, and on other configurations the incorrect union member access may lead to wrong codec configuration values. The bug requires the specific Qualcomm audio hardware driver to be loaded and is limited to the affected mixer controls.
Vulnerability analysis
The driver for this Qualcomm audio codec handles several mixer controls using a larger integer type instead of the correct smaller enumerated type. On 64-bit kernels this causes the kernel to write past the intended control value boundary; on builds with control debugging enabled the kernel catches the mistake and rejects all access to those controls. The corrected driver uses the proper enumerated type when reading and writing these settings, following the same fix already made in similar drivers. Any local user with access to the audio control interface on a system using this codec can reach the bug.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.15 | 5.12 | 5.15.218 | dbc81b518f69 |
| 6.1 | 5.12 | 6.1.185 | f84f2c81d792 |
| 6.12 | 5.12 | 6.12.106 | 2ed3601e9db0 |
| 6.18 | 5.12 | 6.18.47 | b6baab796d11 |
| 6.6 | 5.12 | 6.6.154 | 48b76879f5bf |
| 7.1 | 5.12 | 7.1.10 | 3ee3c26ceee5 |
| mainline | 5.12 | 7.2 | 1ba381759e45 |
| cip/6.1 | 5.12 | 6.1.187-cip60 | f84f2c81d792 |
| cip/6.1-rt | 5.12 | 6.1.189-cip61-rt32 | f84f2c81d792 |
| cip/6.12 | 5.12 | 6.12.108-cip31 | 2ed3601e9db0 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.108-cip31 |
| cip/6.1 | Fixed in 6.1.187-cip60 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |