CVE-2026-80583

ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses

State: Published
Severity: 7.8 High
Published: Aug 26, 2026
Updated: Aug 27, 2026
Reserved: Aug 26, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses

The "DEC0 MODE" to "DEC7 MODE" controls are enumerated, but tx_macro_dec_mode_get() and tx_macro_dec_mode_put() access their value through ucontrol->value.integer.value[0] (a long) instead of ucontrol->value.enumerated.item[0] (an unsigned int).

This same pattern was fixed in the sibling drivers by commit bcfe5f76cc40 ("ASoC: codecs: rx-macro: fix accessing array out of bounds for enum type") and commit 0ea5eff7c606 ("ASoC: codecs: va-macro: fix accessing array out of bounds for enum type"), but tx-macro was missed.

On 64-bit kernels built with CONFIG_SND_CTL_DEBUG, the elem value sanity check catches the 4 bytes written past the enumerated item and every read of these controls fails with -EINVAL:

snd-sm8250 sound: control 2:0:0:DEC0 MODE:0: access overflow

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	c39667ddcfc516fee084e449179d54430a558298 to before dbc81b518f6936131bfd858be71cd4295136809cAffected c39667ddcfc516fee084e449179d54430a558298 to before f84f2c81d792cf1e65571108a3bdd2c29e09e995Affected c39667ddcfc516fee084e449179d54430a558298 to before 48b76879f5bfc8584b99052510ac645c6ade8d2bAffected c39667ddcfc516fee084e449179d54430a558298 to before 2ed3601e9db08fbdb071bd3d7bd8f115d6d871b0Affected c39667ddcfc516fee084e449179d54430a558298 to before b6baab796d11fb84c0e9444ffca91af5eab22c25Affected c39667ddcfc516fee084e449179d54430a558298 to before 3ee3c26ceee562079596abc9bc3307dd56dab4edAffected c39667ddcfc516fee084e449179d54430a558298 to before 1ba381759e45d5d0442452cfa5c42e836191a568Affected
LinuxLinux	5.12Affected before 5.12Not affected 5.15.218 through 5.15.Not affected 6.1.185 through 6.1.Not affected 6.6.154 through 6.6.Not affected 6.12.106 through 6.12.Not affected 6.18.47 through 6.18.Not affected 7.1.10 through 7.1.Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

c39667ddcfc516fee084e449179d54430a558298 to before dbc81b518f6936131bfd858be71cd4295136809cAffected
c39667ddcfc516fee084e449179d54430a558298 to before f84f2c81d792cf1e65571108a3bdd2c29e09e995Affected
c39667ddcfc516fee084e449179d54430a558298 to before 48b76879f5bfc8584b99052510ac645c6ade8d2bAffected
c39667ddcfc516fee084e449179d54430a558298 to before 2ed3601e9db08fbdb071bd3d7bd8f115d6d871b0Affected
c39667ddcfc516fee084e449179d54430a558298 to before b6baab796d11fb84c0e9444ffca91af5eab22c25Affected
c39667ddcfc516fee084e449179d54430a558298 to before 3ee3c26ceee562079596abc9bc3307dd56dab4edAffected
c39667ddcfc516fee084e449179d54430a558298 to before 1ba381759e45d5d0442452cfa5c42e836191a568Affected

LinuxLinux

5.12Affected
before 5.12Not affected
5.15.218 through 5.15.*Not affected
6.1.185 through 6.1.*Not affected
6.6.154 through 6.6.*Not affected
6.12.106 through 6.12.*Not affected
6.18.47 through 6.18.*Not affected
7.1.10 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.