Linux Kernel ASoC EUVD-2026-86764

Requires local access to a system running the Linux ASoC sound/soc/sprd compress-audio platform driver - i.e., Unisoc/Spreadtrum SoC hardware with the SPRD compress PCM device exposed and the calling user permitted to open it (typically audio-group membership, matching PR:L). The attacker configures a fragment_size larger than the fixed 32K IRAM data area and/or a buffer_size larger than the fixed 2M DDR data area via the SNDRV_COMPRESS_SET_PARAMS ioctl, then issues a write(); notably NO SNDRV_PCM_TRIGGER_START and no user interaction are needed. Limiting factors: exploitation is confined to platforms that actually build and load this SPRD driver (hardware-specific), requires local presence and device access, but is otherwise deterministic (AC:L) and does not depend on any non-default configuration flag.

The CVSS 3.1 base vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8, HIGH) is internally consistent with the description: this is a LOCAL (AV:L) vulnerability requiring a low-privileged user (PR:L) with access to the SPRD compress audio device, exploitable deterministically with no race and no user interaction (AC:L/UI:N). No EPSS score, no CISA KEV listing, and no public exploit are present in the input - exploitation status is 'no public exploit identified at time of analysis' (the flaw was found by the 'Atuin' automated discovery engine, whose reproducer is not public). Unlike many sibling kernel CVEs that are crash-dominant DoS mislabeled with C:H/I:H, this one describes a genuine, controlled out-of-bounds WRITE of fully user-controlled data past fixed 32K IRAM and 2M DDR allocations, which is a credible memory-corruption/privilege-escalation primitive rather than a mere crash - so the HIGH integrity/availability impacts are more defensible here than in the DoS-only cousins, though a clean confidentiality-disclosure path (C:H) is not demonstrated. The dominant limiting factor is deployment scope: the sound/soc/sprd driver only exists on Unisoc/Spreadtrum SoC platforms, so real-world exposure is narrow. Net: a legitimate local-LPE-class kernel bug worth patching on affected Unisoc hardware, but low urgency for the general fleet given no active exploitation, no public PoC, and a hardware-specific footprint.

A local user with access to the SPRD compress-audio PCM device opens it and issues SNDRV_COMPRESS_SET_PARAMS with a fragment_size/buffer_size far larger than the fixed 32K IRAM and 2M DDR buffers (the compress core only rejects a u32 overflow of fragment_size*fragments, allowing ~4GB logical sizes). The attacker then simply calls write() while still in SETUP state - no SNDRV_PCM_TRIGGER_START is needed - driving sprd_platform_compr_copy() to copy_from_user() and wrap-copy fully attacker-controlled data past the physical allocations, corrupting adjacent kernel memory. No public exploit exists yet; the flaw was surfaced by an automated discovery engine.