CVE-2026-80583ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses The "DEC0 MODE" to "DEC7 MODE" controls are enumerated, but tx_macro_dec_mode_get() and tx_macro_dec_mode_put() access their value through ucontrol->value.integer.value[0] (a long) instead of ucontrol->value.enumerated.item[0] (an unsigned int). This same pattern was fixed in the sibling drivers by commit bcfe5f76cc40 ("ASoC: codecs: rx-macro: fix accessing array out of bounds for enum type") and commit 0ea5eff7c606 ("ASoC: codecs: va-macro: fix accessing array out of bounds for enum type"), but tx-macro was missed. On 64-bit kernels built with CONFIG_SND_CTL_DEBUG, the elem value sanity check catches the 4 bytes written past the enumerated item and every read of these controls fails with -EINVAL: snd-sm8250 sound: control 2:0:0:DEC0 MODE:0: access overflow
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 27, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from c39667ddcfc516fee084e449179d54430a558298 before dbc81b518f6936131bfd858be71cd4295136809c; from c39667ddcfc516fee084e449179d54430a558298 before f84f2c81d792cf1e65571108a3bdd2c29e09e995; from c39667ddcfc516fee084e449179d54430a558298 before 48b76879f5bfc8584b99052510ac645c6ade8d2b; from c39667ddcfc516fee084e449179d54430a558298 before 2ed3601e9db08fbdb071bd3d7bd8f115d6d871b0; from c39667ddcfc516fee084e449179d54430a558298 before b6baab796d11fb84c0e9444ffca91af5eab22c25; from c39667ddcfc516fee084e449179d54430a558298 before 3ee3c26ceee562079596abc9bc3307dd56dab4ed; from c39667ddcfc516fee084e449179d54430a558298 before 1ba381759e45d5d0442452cfa5c42e836191a568 | CNA record |
References
- https://git.kernel.org/stable/c/dbc81b518f6936131bfd858be71cd4295136809c
- https://git.kernel.org/stable/c/f84f2c81d792cf1e65571108a3bdd2c29e09e995
- https://git.kernel.org/stable/c/48b76879f5bfc8584b99052510ac645c6ade8d2b
- https://git.kernel.org/stable/c/2ed3601e9db08fbdb071bd3d7bd8f115d6d871b0
- https://git.kernel.org/stable/c/b6baab796d11fb84c0e9444ffca91af5eab22c25
- https://git.kernel.org/stable/c/3ee3c26ceee562079596abc9bc3307dd56dab4ed
- https://git.kernel.org/stable/c/1ba381759e45d5d0442452cfa5c42e836191a568
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.