EUVD-2026-66592
GHSA-rvpx-ghpc-j5cf
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local access with low privileges sufficient to write ALSA controls; unchecked kernel array index enables out-of-bounds read/write with full C/I/A impact.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
ASoC: tas2562: Validate values for volume writes
tas2562_volume_control_put() does not do any validation of the control value written by userspace, it uses it to look up a value in a fixed size array which can easily be overflowed and then writes whatever value it gets back to the device. Add validation that we are loading a value we have in the array.
AnalysisAI
Out-of-bounds array access in the Linux kernel's ASoC tas2562 audio driver allows local, low-privileged users to trigger kernel memory corruption by supplying unvalidated volume control values via the ALSA interface. The tas2562_volume_control_put() function accepts arbitrary userspace-supplied integers and uses them as unchecked array indices to look up a fixed-size table, potentially reading out-of-bounds kernel memory and writing that value to the TAS2562 hardware device over I2C. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must have an interactive local session or code execution on a Linux system that physically incorporates a Texas Instruments TAS2562 audio amplifier with the snd-soc-tas2562 kernel module loaded. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8) accurately reflects the attack surface: exploitation requires a local interactive account with write access to ALSA mixer controls, which on typical desktop and embedded Linux configurations is granted to users in the audio group or any logged-in user. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local user on a Linux embedded or mobile system with a TAS2562 amplifier writes a crafted out-of-bounds integer to the ALSA volume control - for example via amixer or a direct ioctl - causing the kernel to index beyond the bounds of the volume lookup table. The kernel reads arbitrary memory at the computed offset and writes it to the TAS2562 device, potentially leaking kernel memory contents or causing a memory corruption condition exploitable for local privilege escalation. … |
| Remediation | The primary remediation is to upgrade the Linux kernel to a patched stable release: 6.6.153, 6.12.105, 6.18.46, 7.1.10, or the 7.2 mainline. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify systems running Linux kernels with the tas2562 audio driver enabled and document current kernel versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today