Description

In the Linux kernel, the following vulnerability has been resolved: ASoC: tas2562: Validate values for volume writes tas2562_volume_control_put() does not do any validation of the control value written by userspace, it uses it to look up a value in a fixed size array which can easily be overflowed and then writes whatever value it gets back to the device. Add validation that we are loading a value we have in the array.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-26T15:17:06.350Z",
  "pubdate": "2026-08-26T15:17:06.350Z",
  "executiveSummary": "The Linux kernel ASoC driver for the TAS2562 audio amplifier contains an improper input validation vulnerability within the volume control mechanism. This flaw allows a local, unprivileged user to supply arbitrary control values that are subsequently used as indices for array lookups without bounds checking. An attacker can leverage this condition to perform an out-of-bounds memory access, potentially leading to information disclosure or the corruption of sensitive kernel memory. The vulnerability resides in the tas2562_volume_control_put() function, which fails to verify that the user-provided volume input corresponds to a valid entry within the driver's predefined configuration array. Successful exploitation allows for the execution of unauthorized writes to the device and potentially triggers kernel-level memory corruption. This issue represents a significant risk to system integrity and stability on affected platforms utilizing the TAS2562 amplifier, as it permits low-privileged processes to interact with hardware registers in an uncontrolled manner.",
  "technicalDetails": "The vulnerability is rooted in the lack of bounds validation within the tas2562_volume_control_put() function, which handles volume control updates for the TAS2562 audio amplifier. In the ASoC (ALSA System on Chip) subsystem, user-space applications interact with kernel controls via the ALSA control interface. When a user writes a value to the volume control, the driver invokes the associated put callback, which is tasked with parsing the user input and applying the configuration to the hardware.\nIn the vulnerable implementation, the driver accepts an integer index provided by userspace without ensuring it falls within the permitted range of the internal configuration array. This array, which maps logical volume levels to specific register values, is of a fixed, finite size. Because the input is used directly as an index to access this array, a value provided by an attacker that exceeds the array size results in an out-of-bounds read. The function then proceeds to retrieve whatever data exists at that invalid memory location and writes that data directly to the TAS2562 device registers.\nThe exploitation flow is as follows: first, a malicious actor identifies the ALSA control node associated with the TAS2562 device. Second, the actor crafts a malicious input value that serves as an out-of-bounds index for the driver's lookup table. When the kernel processes the write request, it performs the lookup using the attacker-supplied index, effectively reading adjacent kernel memory as if it were a valid configuration parameter. Third, the driver writes this memory content into the device's control registers. This allows an attacker to manipulate the amplifier's hardware state using arbitrary data found in kernel memory, or potentially trigger a kernel crash (DoS) if the out-of-bounds read accesses unmapped or protected memory regions.\nThis vulnerability highlights a failure in trust boundary enforcement between userspace input and kernel-level hardware configuration interfaces. While the issue is primarily an out-of-bounds access, the subsequent register write propagates the impact, potentially facilitating side-channel attacks or system instability. The vulnerability is present in the Linux kernel's tas2562 audio driver and requires local access to the ALSA device node, typically found under /dev/snd/controlC*. No specific network exposure is required, as the vector is local and interface-based."
}