CVE-2026-80526ASoC: tas2562: Validate values for volume writes
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: ASoC: tas2562: Validate values for volume writes tas2562_volume_control_put() does not do any validation of the control value written by userspace, it uses it to look up a value in a fixed size array which can easily be overflowed and then writes whatever value it gets back to the device. Add validation that we are loading a value we have in the array.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 27, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from bf726b1c86f2caab70ad614cdf7da3b81ad08e69 before 1f389ecd0c35e9e281036e44c121df904f3164c1; from bf726b1c86f2caab70ad614cdf7da3b81ad08e69 before 20bdbb1376457ecbf418bf677fd285820d1fc011; from bf726b1c86f2caab70ad614cdf7da3b81ad08e69 before db488d653d896fcf9ac87e15239924c2928bbc3c; from bf726b1c86f2caab70ad614cdf7da3b81ad08e69 before c37a0461c0d0a70c5de4fdbd70449a7f53c12dda; from bf726b1c86f2caab70ad614cdf7da3b81ad08e69 before 8fb41964f7e4e4207c8999af2056894caa7a252a | CNA record |
References
- https://git.kernel.org/stable/c/1f389ecd0c35e9e281036e44c121df904f3164c1
- https://git.kernel.org/stable/c/20bdbb1376457ecbf418bf677fd285820d1fc011
- https://git.kernel.org/stable/c/db488d653d896fcf9ac87e15239924c2928bbc3c
- https://git.kernel.org/stable/c/c37a0461c0d0a70c5de4fdbd70449a7f53c12dda
- https://git.kernel.org/stable/c/8fb41964f7e4e4207c8999af2056894caa7a252a
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.