EUVD-2026-66498
GHSA-4jrc-26j5-hv3j
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AC:H reflects hardware-specific driver dependency (Qualcomm LPASS SoC required); PR:L because audio-group local access suffices; full C/I/A retained for kernel memory corruption potential.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses
The "DEC0 MODE" to "DEC7 MODE" controls are enumerated, but tx_macro_dec_mode_get() and tx_macro_dec_mode_put() access their value through ucontrol->value.integer.value[0] (a long) instead of ucontrol->value.enumerated.item[0] (an unsigned int).
This same pattern was fixed in the sibling drivers by commit bcfe5f76cc40 ("ASoC: codecs: rx-macro: fix accessing array out of bounds for enum type") and commit 0ea5eff7c606 ("ASoC: codecs: va-macro: fix accessing array out of bounds for enum type"), but tx-macro was missed.
On 64-bit kernels built with CONFIG_SND_CTL_DEBUG, the elem value sanity check catches the 4 bytes written past the enumerated item and every read of these controls fails with -EINVAL:
snd-sm8250 sound: control 2:0:0:DEC0 MODE:0: access overflow
AnalysisAI
Out-of-bounds memory write in the Linux kernel's ASoC lpass-tx-macro audio codec driver allows a local low-privileged user to corrupt kernel memory via misconfigured ALSA enum kcontrol access, with potential for privilege escalation. The driver's get and put handlers for DEC0-DEC7 MODE controls incorrectly access the 8-byte integer union field instead of the 4-byte enumerated union field, writing 4 bytes beyond the intended boundary on 64-bit systems. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a local user account with access to the ALSA control interface (typically membership in the 'audio' group or access to /dev/snd/controlC* on Linux desktop/mobile systems). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) treats this as a straightforward local privilege escalation via kernel memory corruption. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local user on a Qualcomm LPASS-equipped Linux device (e.g., a Snapdragon-based development board or phone running mainline Linux) opens an ALSA control interface and issues a write to one of the DEC0-DEC7 MODE enum controls. Because the driver reads value.integer.value[0] (a long) rather than value.enumerated.item[0] (unsigned int), an attacker who controls the upper 4 bytes of the integer value can influence kernel memory adjacent to the enumerated item field. … |
| Remediation | The primary fix is to upgrade to Linux kernel 7.2 or Linux 7.1.10, both of which include the corrected enum kcontrol access. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory Linux systems in use and identify which have the audio subsystem enabled, noting their current kernel versions and Linux distribution. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today