EUVD-2026-59440
GHSA-p8cv-f9j9-548c
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local attack vector confirmed; low privilege (ALSA write access) sufficient; no UI needed; kernel OOB justifies C:H/I:H/A:H within the unscoped vulnerable component.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
ASoC: fsl: fsl_audmix: Validate written enum values
fsl_audmix_put_mix_clk_src() and fsl_audmix_put_out_src() convert the user-provided enum item with snd_soc_enum_item_to_val() before checking whether the item is within the enum's item count.
The generic snd_soc_put_enum_double() helper performs that validation, but these callbacks use the converted value first: the clock-source path tests it with BIT(), and the output-source path indexes the prms transition table with it.
Reject out-of-range enum items before converting them.
AnalysisAI
Input validation bypass in the Linux kernel's FSL audmix ASoC driver allows a local low-privileged user to write out-of-range enum values to ALSA mixer controls, triggering out-of-bounds memory access in kernel space with potential for privilege escalation or kernel memory disclosure. Specifically, fsl_audmix_put_mix_clk_src() uses an unvalidated value in a BIT() shift operation, and fsl_audmix_put_out_src() uses it to index the prms transition table, both before any bounds check is performed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target system must be running an NXP/Freescale i.MX SoC with the fsl_audmix audio mixer driver loaded - this driver is not present or active on general-purpose x86/ARM64 servers or desktops. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates a locally exploitable, low-complexity flaw with high impact to confidentiality, integrity, and availability in the vulnerable component. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local low-privileged user on an NXP i.MX-based embedded Linux system - such as an industrial controller, media device, or development board running an unpatched kernel - writes a crafted out-of-range integer to the audmix ALSA mixer control interface (e.g., via amixer or direct /dev/snd ioctl). The kernel callback passes the value to snd_soc_enum_item_to_val() and immediately uses the result in a BIT() shift or as a prms array index without bounds validation, causing a kernel out-of-bounds memory access that may disclose kernel memory contents or corrupt adjacent kernel structures, enabling privilege escalation. … |
| Remediation | The primary fix is to upgrade the Linux kernel to a patched stable release: 5.10.261 or later in the 5.10 branch, 5.15.212 or later in the 5.15 branch, 6.1.178 or later in the 6.1 branch, 6.6.145 or later in the 6.6 branch, 6.12.97 or later in the 6.12 branch, 6.18.40 or later in the 6.18 branch, or 7.1.5 or later in the 7.1 branch. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify Linux systems in your infrastructure running the FSL audmix ASoC audio driver. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today