Linux Kernel EUVD-2026-66498

Exploitation requires a local user account with access to the ALSA control interface (typically membership in the 'audio' group or access to /dev/snd/controlC* on Linux desktop/mobile systems). The target system must be running a 64-bit Linux kernel - the 4-byte overrun only materializes on 64-bit architectures where sizeof(long) = 8 but sizeof(unsigned int) = 4. The system must be equipped with Qualcomm LPASS TX Macro hardware (e.g., SM8250/Snapdragon 865 or similar SoC) and the lpass-tx-macro kernel module must be loaded. On kernels compiled with CONFIG_SND_CTL_DEBUG=y, the bug is fully mitigated by the sanity check (returns -EINVAL), limiting the vulnerable population to production/non-debug kernel builds. Network exploitation is not possible - this is a purely local attack requiring physical or shell access.

The NVD-assigned CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) treats this as a straightforward local privilege escalation via kernel memory corruption. However, real-world exploitability is significantly constrained: first, the lpass-tx-macro driver is specific to Qualcomm LPASS audio hardware (primarily Snapdragon SoCs running mainline Linux), severely limiting the attack surface to a narrow hardware target. Second, the 4-byte overwrite lands within the snd_ctl_elem_value union rather than arbitrary kernel memory, meaning controlled exploitation would require non-trivial heap-shaping primitives. Third, on debug kernels the bug is entirely blocked by CONFIG_SND_CTL_DEBUG. No EPSS score was provided, no KEV listing exists, and no public exploit code has been identified at time of analysis, all pointing to low near-term exploitation probability. The AC:L assignment in the NVD vector may overstate exploitability - the Qualcomm hardware dependency functions as an implicit complexity barrier. Overall this is a genuine kernel memory safety issue worth patching but presents low immediate exploitation risk outside of targeted research against Qualcomm-based Linux platforms.

A local user on a Qualcomm LPASS-equipped Linux device (e.g., a Snapdragon-based development board or phone running mainline Linux) opens an ALSA control interface and issues a write to one of the DEC0-DEC7 MODE enum controls. Because the driver reads value.integer.value[0] (a long) rather than value.enumerated.item[0] (unsigned int), an attacker who controls the upper 4 bytes of the integer value can influence kernel memory adjacent to the enumerated item field. On a non-debug kernel without CONFIG_SND_CTL_DEBUG, this write succeeds silently and the corrupted bytes may be leveraged through further heap manipulation to achieve kernel privilege escalation.