Linux Kernel CVE-2026-80526

The attacker must have an interactive local session or code execution on a Linux system that physically incorporates a Texas Instruments TAS2562 audio amplifier with the snd-soc-tas2562 kernel module loaded. The attacker's user account must have write access to the ALSA mixer control for TAS2562 volume - on many desktop and embedded Linux distributions, membership in the 'audio' group (or equivalent) grants this by default. Exploitation is specifically blocked by: absence of TAS2562 hardware, the snd-soc-tas2562 module not being loaded, strict DAC or MAC policy (SELinux/AppArmor) restricting /dev/snd access, or container isolation without audio device pass-through. No remote or unauthenticated exploitation path exists; the attacker must have at minimum low-privilege local code execution on the target host.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8) accurately reflects the attack surface: exploitation requires a local interactive account with write access to ALSA mixer controls, which on typical desktop and embedded Linux configurations is granted to users in the audio group or any logged-in user. No EPSS score was provided in the available data, and CISA KEV listing is absent, confirming no reported active exploitation at time of analysis. The absence of a formal CWE assignment is a minor data gap; the out-of-bounds array access root cause is unambiguous from the commit description. Real-world blast radius is substantially narrowed by the hardware dependency: only systems physically equipped with a TAS2562 amplifier and the snd-soc-tas2562 module loaded are exploitable, effectively excluding general-purpose servers and cloud workloads. Prioritization should reflect the deployment context - embedded Linux, mobile, and IoT platforms with TAS2562 hardware warrant patch-cycle remediation; emergency response posture is not justified by available signals.

A local user on a Linux embedded or mobile system with a TAS2562 amplifier writes a crafted out-of-bounds integer to the ALSA volume control - for example via amixer or a direct ioctl - causing the kernel to index beyond the bounds of the volume lookup table. The kernel reads arbitrary memory at the computed offset and writes it to the TAS2562 device, potentially leaking kernel memory contents or causing a memory corruption condition exploitable for local privilege escalation. No public proof-of-concept exploit has been identified at time of analysis.