Description

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses The "DEC0 MODE" to "DEC7 MODE" controls are enumerated, but tx_macro_dec_mode_get() and tx_macro_dec_mode_put() access their value through ucontrol->value.integer.value[0] (a long) instead of ucontrol->value.enumerated.item[0] (an unsigned int). This same pattern was fixed in the sibling drivers by commit bcfe5f76cc40 ("ASoC: codecs: rx-macro: fix accessing array out of bounds for enum type") and commit 0ea5eff7c606 ("ASoC: codecs: va-macro: fix accessing array out of bounds for enum type"), but tx-macro was missed. On 64-bit kernels built with CONFIG_SND_CTL_DEBUG, the elem value sanity check catches the 4 bytes written past the enumerated item and every read of these controls fails with -EINVAL: snd-sm8250 sound: control 2:0:0:DEC0 MODE:0: access overflow

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-26T15:17:14.437Z",
  "pubdate": "2026-08-26T15:17:14.437Z",
  "executiveSummary": "This vulnerability involves an improper type usage in the Linux kernel ASoC (ALSA System on Chip) subsystem specifically within the lpass-tx-macro codec driver.\nThe vulnerability occurs because enumerated kcontrols are incorrectly accessed using integer types instead of enumerated types.\nThis mismatch leads to an out-of-bounds memory access, which is intercepted by kernel sanity checks when CONFIG_SND_CTL_DEBUG is enabled.\nThe primary impact is a denial-of-service (DoS) condition regarding specific audio control settings, as read/write operations for 'DEC0 MODE' through 'DEC7 MODE' controls return -EINVAL.\nAttackers with access to the ALSA control interface could potentially leverage this bug to trigger error conditions, destabilizing the sound subsystem functionality on affected mobile hardware.\nThe vulnerability affects Linux kernel versions utilizing the LPASS TX macro hardware abstraction, primarily associated with Qualcomm SoC audio subsystems.",
  "technicalDetails": "The root cause of the vulnerability lies in the improper implementation of the getter (tx_macro_dec_mode_get) and setter (tx_macro_dec_mode_put) functions for enumerated kcontrols within the 'lpass-tx-macro' codec driver.\nIn the ALSA control API, enumerated controls must store their values within the 'ucontrol->value.enumerated.item' array (which expects unsigned integers). The driver, however, incorrectly accesses the data via 'ucontrol->value.integer.value' (which expects long integers).\nOn 64-bit systems, the size difference between a long and an enumerated item leads to a discrepancy in memory mapping within the control structure. Specifically, attempting to access the value as a long writes 8 bytes where the API expects a 4-byte enumerated value.\nWhen CONFIG_SND_CTL_DEBUG is enabled, the kernel performs an 'elem value' sanity check. This check identifies the 4-byte overflow resulting from the incorrect type usage and prevents the operation, returning -EINVAL to the caller. This results in the specific error message: 'snd-sm8250 sound: control 2:0:0:DEC0 MODE:0: access overflow'.\nThe attack flow involves a user-space process (e.g., an audio server or a malicious application with permissions to interact with /dev/snd/controlC*) issuing an IOCTL to read or write the decimation mode settings for the TX Macro codec. The kernel's validation logic detects the memory misalignment caused by the type mismatch and halts the request.\nBecause the control interface is frequently exposed to user-space, an unprivileged user capable of issuing ALSA control commands can consistently trigger this error. While the current implementation prevents a heap overflow by triggering an explicit error, the misalignment reflects a failure in kernel memory safety for this specific driver path. Similar vulnerabilities were previously identified and patched in the 'rx-macro' and 'va-macro' drivers, suggesting a systematic oversight in the driver development pattern for these Qualcomm-based audio components."
}