{"id":"CVE-2026-80583","state":"PUBLISHED","title":"ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses\n\nThe \"DEC0 MODE\" to \"DEC7 MODE\" controls are enumerated, but\ntx_macro_dec_mode_get() and tx_macro_dec_mode_put() access their\nvalue through ucontrol->value.integer.value[0] (a long) instead of\nucontrol->value.enumerated.item[0] (an unsigned int).\n\nThis same pattern was fixed in the sibling drivers by\ncommit bcfe5f76cc40 (\"ASoC: codecs: rx-macro: fix accessing array\nout of bounds for enum type\") and\ncommit 0ea5eff7c606 (\"ASoC: codecs: va-macro: fix accessing array\nout of bounds for enum type\"), but tx-macro was missed.\n\nOn 64-bit kernels built with CONFIG_SND_CTL_DEBUG, the elem value\nsanity check catches the 4 bytes written past the enumerated item\nand every read of these controls fails with -EINVAL:\n\n  snd-sm8250 sound: control 2:0:0:DEC0 MODE:0: access overflow","publishedAt":"2026-08-26T14:37:39.704Z","updatedAt":"2026-08-27T12:40:21.902Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"c39667ddcfc516fee084e449179d54430a558298","status":"affected","lessThan":"dbc81b518f6936131bfd858be71cd4295136809c","versionType":"git"},{"version":"c39667ddcfc516fee084e449179d54430a558298","status":"affected","lessThan":"f84f2c81d792cf1e65571108a3bdd2c29e09e995","versionType":"git"},{"version":"c39667ddcfc516fee084e449179d54430a558298","status":"affected","lessThan":"48b76879f5bfc8584b99052510ac645c6ade8d2b","versionType":"git"},{"version":"c39667ddcfc516fee084e449179d54430a558298","status":"affected","lessThan":"2ed3601e9db08fbdb071bd3d7bd8f115d6d871b0","versionType":"git"},{"version":"c39667ddcfc516fee084e449179d54430a558298","status":"affected","lessThan":"b6baab796d11fb84c0e9444ffca91af5eab22c25","versionType":"git"},{"version":"c39667ddcfc516fee084e449179d54430a558298","status":"affected","lessThan":"3ee3c26ceee562079596abc9bc3307dd56dab4ed","versionType":"git"},{"version":"c39667ddcfc516fee084e449179d54430a558298","status":"affected","lessThan":"1ba381759e45d5d0442452cfa5c42e836191a568","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["sound/soc/codecs/lpass-tx-macro.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.12","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.12","versionType":"semver"},{"version":"5.15.218","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.185","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.154","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.106","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.47","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.10","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["sound/soc/codecs/lpass-tx-macro.c"]}],"references":["https://git.kernel.org/stable/c/dbc81b518f6936131bfd858be71cd4295136809c","https://git.kernel.org/stable/c/f84f2c81d792cf1e65571108a3bdd2c29e09e995","https://git.kernel.org/stable/c/48b76879f5bfc8584b99052510ac645c6ade8d2b","https://git.kernel.org/stable/c/2ed3601e9db08fbdb071bd3d7bd8f115d6d871b0","https://git.kernel.org/stable/c/b6baab796d11fb84c0e9444ffca91af5eab22c25","https://git.kernel.org/stable/c/3ee3c26ceee562079596abc9bc3307dd56dab4ed","https://git.kernel.org/stable/c/1ba381759e45d5d0442452cfa5c42e836191a568"],"weaknesses":[],"ingestedAt":"2026-10-29T20:13:07.220Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/80xxx/CVE-2026-80583.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-80583","state":"PUBLISHED","datePublished":"2026-08-26T14:37:39.704Z","dateUpdated":"2026-08-27T12:40:21.902Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-08-26T14:34:25.769Z"},"containers":{"cna":{"title":"ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses\n\nThe \"DEC0 MODE\" to \"DEC7 MODE\" controls are enumerated, but\ntx_macro_dec_mode_get() and tx_macro_dec_mode_put() access their\nvalue through ucontrol->value.integer.value[0] (a long) instead of\nucontrol->value.enumerated.item[0] (an unsigned int).\n\nThis same pattern was fixed in the sibling drivers by\ncommit bcfe5f76cc40 (\"ASoC: codecs: rx-macro: fix accessing array\nout of bounds for enum type\") and\ncommit 0ea5eff7c606 (\"ASoC: codecs: va-macro: fix accessing array\nout of bounds for enum type\"), but tx-macro was missed.\n\nOn 64-bit kernels built with CONFIG_SND_CTL_DEBUG, the elem value\nsanity check catches the 4 bytes written past the enumerated item\nand every read of these controls fails with -EINVAL:\n\n  snd-sm8250 sound: control 2:0:0:DEC0 MODE:0: access overflow"}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"c39667ddcfc516fee084e449179d54430a558298","status":"affected","lessThan":"dbc81b518f6936131bfd858be71cd4295136809c","versionType":"git"},{"version":"c39667ddcfc516fee084e449179d54430a558298","status":"affected","lessThan":"f84f2c81d792cf1e65571108a3bdd2c29e09e995","versionType":"git"},{"version":"c39667ddcfc516fee084e449179d54430a558298","status":"affected","lessThan":"48b76879f5bfc8584b99052510ac645c6ade8d2b","versionType":"git"},{"version":"c39667ddcfc516fee084e449179d54430a558298","status":"affected","lessThan":"2ed3601e9db08fbdb071bd3d7bd8f115d6d871b0","versionType":"git"},{"version":"c39667ddcfc516fee084e449179d54430a558298","status":"affected","lessThan":"b6baab796d11fb84c0e9444ffca91af5eab22c25","versionType":"git"},{"version":"c39667ddcfc516fee084e449179d54430a558298","status":"affected","lessThan":"3ee3c26ceee562079596abc9bc3307dd56dab4ed","versionType":"git"},{"version":"c39667ddcfc516fee084e449179d54430a558298","status":"affected","lessThan":"1ba381759e45d5d0442452cfa5c42e836191a568","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["sound/soc/codecs/lpass-tx-macro.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.12","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.12","versionType":"semver"},{"version":"5.15.218","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.185","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.154","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.106","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.47","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.10","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["sound/soc/codecs/lpass-tx-macro.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/dbc81b518f6936131bfd858be71cd4295136809c"},{"url":"https://git.kernel.org/stable/c/f84f2c81d792cf1e65571108a3bdd2c29e09e995"},{"url":"https://git.kernel.org/stable/c/48b76879f5bfc8584b99052510ac645c6ade8d2b"},{"url":"https://git.kernel.org/stable/c/2ed3601e9db08fbdb071bd3d7bd8f115d6d871b0"},{"url":"https://git.kernel.org/stable/c/b6baab796d11fb84c0e9444ffca91af5eab22c25"},{"url":"https://git.kernel.org/stable/c/3ee3c26ceee562079596abc9bc3307dd56dab4ed"},{"url":"https://git.kernel.org/stable/c/1ba381759e45d5d0442452cfa5c42e836191a568"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local SNDRV_CTL_IOCTL_ELEM_READ or SNDRV_CTL_IOCTL_ELEM_WRITE on /dev/snd/controlC* through snd_ctl_ioctl() to tx_macro_dec_mode_get/put(); the Qualcomm LPASS TX macro audio codec driver has no network, Bluetooth, or physical-input attack path.\nAC:L - A single ioctl targeting DEC0-7 MODE deterministically triggers the 8-byte integer access against a 4-byte enumerated field on 64-bit kernels; the attacker controls both sides with no race, timing, or memory-layout dependency.\nPR:L - snd_ctl_open() performs no capability check; exploitation needs only local access to /dev/snd/controlC*, typically granted to the audio group on Qualcomm sc8250/sc8280 Chromebooks and Linux dev boards where this driver is present, not real root.\nUI:N - Once the attacker has ALSA control-device access they issue elem read/write ioctls themselves to DEC MODE controls; no separate victim action such as plugging hardware or opening a file is required.\nS:U - The out-of-bounds ctl-value access and resulting microphone ADC mode corruption remain within the host kernel and Qualcomm audio subsystem; there is no crossing of VM, container, or IOMMU security boundaries.\nC:H - tx_macro_dec_mode_put() reads ucontrol->value.integer.value[0] (8 bytes) for ENUM controls, performing a 4-byte out-of-bounds read past enumerated.item[0]; per kernel CVSS guidance out-of-bounds reads are scored High even when bounded.\nI:H - tx_macro_dec_mode_get() writes 8 bytes via integer.value[0], overflowing enumerated.item[0] by 4 bytes in kernel memory; put stores values into tx->dec_mode[] that program CDC_TXn_ADC_MODE on phone/Chromebook microphones, constituting memory corruption scored High.\nA:H - With CONFIG_SND_CTL_DEBUG every DEC0-7 MODE read fails with -EINVAL (access overflow), denying microphone ADC queries; on production 64-bit aarch64 builds the 4-byte union overrun corrupts ctl values and can break Qualcomm LPASS TX audio capture availability."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-27T12:40:21.902Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.12","versionEndExcluding":"5.15.218"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.12","versionEndExcluding":"6.1.185"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.12","versionEndExcluding":"6.6.154"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.12","versionEndExcluding":"6.12.106"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.12","versionEndExcluding":"6.18.47"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.12","versionEndExcluding":"7.1.10"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.12","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}