GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-80583 (GCVE-0-2026-80583)

Vulnerability from cvelistv5 – Published: 2026-08-26 14:37 – Updated: 2026-08-27 12:40
VLAI
Title
ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses
Summary
In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses The "DEC0 MODE" to "DEC7 MODE" controls are enumerated, but tx_macro_dec_mode_get() and tx_macro_dec_mode_put() access their value through ucontrol->value.integer.value[0] (a long) instead of ucontrol->value.enumerated.item[0] (an unsigned int). This same pattern was fixed in the sibling drivers by commit bcfe5f76cc40 ("ASoC: codecs: rx-macro: fix accessing array out of bounds for enum type") and commit 0ea5eff7c606 ("ASoC: codecs: va-macro: fix accessing array out of bounds for enum type"), but tx-macro was missed. On 64-bit kernels built with CONFIG_SND_CTL_DEBUG, the elem value sanity check catches the 4 bytes written past the enumerated item and every read of these controls fails with -EINVAL: snd-sm8250 sound: control 2:0:0:DEC0 MODE:0: access overflow
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: c39667ddcfc516fee084e449179d54430a558298 , < dbc81b518f6936131bfd858be71cd4295136809c (git)
Affected: c39667ddcfc516fee084e449179d54430a558298 , < f84f2c81d792cf1e65571108a3bdd2c29e09e995 (git)
Affected: c39667ddcfc516fee084e449179d54430a558298 , < 48b76879f5bfc8584b99052510ac645c6ade8d2b (git)
Affected: c39667ddcfc516fee084e449179d54430a558298 , < 2ed3601e9db08fbdb071bd3d7bd8f115d6d871b0 (git)
Affected: c39667ddcfc516fee084e449179d54430a558298 , < b6baab796d11fb84c0e9444ffca91af5eab22c25 (git)
Affected: c39667ddcfc516fee084e449179d54430a558298 , < 3ee3c26ceee562079596abc9bc3307dd56dab4ed (git)
Affected: c39667ddcfc516fee084e449179d54430a558298 , < 1ba381759e45d5d0442452cfa5c42e836191a568 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.12
Unaffected: 0 , < 5.12 (semver)
Unaffected: 5.15.218 , ≤ 5.15.* (semver)
Unaffected: 6.1.185 , ≤ 6.1.* (semver)
Unaffected: 6.6.154 , ≤ 6.6.* (semver)
Unaffected: 6.12.106 , ≤ 6.12.* (semver)
Unaffected: 6.18.47 , ≤ 6.18.* (semver)
Unaffected: 7.1.10 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/soc/codecs/lpass-tx-macro.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "dbc81b518f6936131bfd858be71cd4295136809c",
              "status": "affected",
              "version": "c39667ddcfc516fee084e449179d54430a558298",
              "versionType": "git"
            },
            {
              "lessThan": "f84f2c81d792cf1e65571108a3bdd2c29e09e995",
              "status": "affected",
              "version": "c39667ddcfc516fee084e449179d54430a558298",
              "versionType": "git"
            },
            {
              "lessThan": "48b76879f5bfc8584b99052510ac645c6ade8d2b",
              "status": "affected",
              "version": "c39667ddcfc516fee084e449179d54430a558298",
              "versionType": "git"
            },
            {
              "lessThan": "2ed3601e9db08fbdb071bd3d7bd8f115d6d871b0",
              "status": "affected",
              "version": "c39667ddcfc516fee084e449179d54430a558298",
              "versionType": "git"
            },
            {
              "lessThan": "b6baab796d11fb84c0e9444ffca91af5eab22c25",
              "status": "affected",
              "version": "c39667ddcfc516fee084e449179d54430a558298",
              "versionType": "git"
            },
            {
              "lessThan": "3ee3c26ceee562079596abc9bc3307dd56dab4ed",
              "status": "affected",
              "version": "c39667ddcfc516fee084e449179d54430a558298",
              "versionType": "git"
            },
            {
              "lessThan": "1ba381759e45d5d0442452cfa5c42e836191a568",
              "status": "affected",
              "version": "c39667ddcfc516fee084e449179d54430a558298",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/soc/codecs/lpass-tx-macro.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "lessThan": "5.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.218",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.185",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.154",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.106",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.47",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.218",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.185",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.154",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.106",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.47",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.10",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses\n\nThe \"DEC0 MODE\" to \"DEC7 MODE\" controls are enumerated, but\ntx_macro_dec_mode_get() and tx_macro_dec_mode_put() access their\nvalue through ucontrol-\u003evalue.integer.value[0] (a long) instead of\nucontrol-\u003evalue.enumerated.item[0] (an unsigned int).\n\nThis same pattern was fixed in the sibling drivers by\ncommit bcfe5f76cc40 (\"ASoC: codecs: rx-macro: fix accessing array\nout of bounds for enum type\") and\ncommit 0ea5eff7c606 (\"ASoC: codecs: va-macro: fix accessing array\nout of bounds for enum type\"), but tx-macro was missed.\n\nOn 64-bit kernels built with CONFIG_SND_CTL_DEBUG, the elem value\nsanity check catches the 4 bytes written past the enumerated item\nand every read of these controls fails with -EINVAL:\n\n  snd-sm8250 sound: control 2:0:0:DEC0 MODE:0: access overflow"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local SNDRV_CTL_IOCTL_ELEM_READ or SNDRV_CTL_IOCTL_ELEM_WRITE on /dev/snd/controlC* through snd_ctl_ioctl() to tx_macro_dec_mode_get/put(); the Qualcomm LPASS TX macro audio codec driver has no network, Bluetooth, or physical-input attack path.\nAC:L - A single ioctl targeting DEC0-7 MODE deterministically triggers the 8-byte integer access against a 4-byte enumerated field on 64-bit kernels; the attacker controls both sides with no race, timing, or memory-layout dependency.\nPR:L - snd_ctl_open() performs no capability check; exploitation needs only local access to /dev/snd/controlC*, typically granted to the audio group on Qualcomm sc8250/sc8280 Chromebooks and Linux dev boards where this driver is present, not real root.\nUI:N - Once the attacker has ALSA control-device access they issue elem read/write ioctls themselves to DEC MODE controls; no separate victim action such as plugging hardware or opening a file is required.\nS:U - The out-of-bounds ctl-value access and resulting microphone ADC mode corruption remain within the host kernel and Qualcomm audio subsystem; there is no crossing of VM, container, or IOMMU security boundaries.\nC:H - tx_macro_dec_mode_put() reads ucontrol-\u003evalue.integer.value[0] (8 bytes) for ENUM controls, performing a 4-byte out-of-bounds read past enumerated.item[0]; per kernel CVSS guidance out-of-bounds reads are scored High even when bounded.\nI:H - tx_macro_dec_mode_get() writes 8 bytes via integer.value[0], overflowing enumerated.item[0] by 4 bytes in kernel memory; put stores values into tx-\u003edec_mode[] that program CDC_TXn_ADC_MODE on phone/Chromebook microphones, constituting memory corruption scored High.\nA:H - With CONFIG_SND_CTL_DEBUG every DEC0-7 MODE read fails with -EINVAL (access overflow), denying microphone ADC queries; on production 64-bit aarch64 builds the 4-byte union overrun corrupts ctl values and can break Qualcomm LPASS TX audio capture availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T12:40:21.902Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/dbc81b518f6936131bfd858be71cd4295136809c"
        },
        {
          "url": "https://git.kernel.org/stable/c/f84f2c81d792cf1e65571108a3bdd2c29e09e995"
        },
        {
          "url": "https://git.kernel.org/stable/c/48b76879f5bfc8584b99052510ac645c6ade8d2b"
        },
        {
          "url": "https://git.kernel.org/stable/c/2ed3601e9db08fbdb071bd3d7bd8f115d6d871b0"
        },
        {
          "url": "https://git.kernel.org/stable/c/b6baab796d11fb84c0e9444ffca91af5eab22c25"
        },
        {
          "url": "https://git.kernel.org/stable/c/3ee3c26ceee562079596abc9bc3307dd56dab4ed"
        },
        {
          "url": "https://git.kernel.org/stable/c/1ba381759e45d5d0442452cfa5c42e836191a568"
        }
      ],
      "title": "ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80583",
    "datePublished": "2026-08-26T14:37:39.704Z",
    "dateReserved": "2026-08-26T14:34:25.769Z",
    "dateUpdated": "2026-08-27T12:40:21.902Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80583",
      "date": "2026-09-15",
      "epss": "0.0012",
      "percentile": "0.02084"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-27T01:03:07.000Z",
      "cve": "CVE-2026-80583",
      "id": "msrc_CVE-2026-80583",
      "initial_release_date": "2026-08-27T01:03:07.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-80583.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-80583\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-26T15:17:14.437\",\"lastModified\":\"2026-08-27T13:18:40.937\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses\\n\\nThe \\\"DEC0 MODE\\\" to \\\"DEC7 MODE\\\" controls are enumerated, but\\ntx_macro_dec_mode_get() and tx_macro_dec_mode_put() access their\\nvalue through ucontrol-\u003evalue.integer.value[0] (a long) instead of\\nucontrol-\u003evalue.enumerated.item[0] (an unsigned int).\\n\\nThis same pattern was fixed in the sibling drivers by\\ncommit bcfe5f76cc40 (\\\"ASoC: codecs: rx-macro: fix accessing array\\nout of bounds for enum type\\\") and\\ncommit 0ea5eff7c606 (\\\"ASoC: codecs: va-macro: fix accessing array\\nout of bounds for enum type\\\"), but tx-macro was missed.\\n\\nOn 64-bit kernels built with CONFIG_SND_CTL_DEBUG, the elem value\\nsanity check catches the 4 bytes written past the enumerated item\\nand every read of these controls fails with -EINVAL:\\n\\n  snd-sm8250 sound: control 2:0:0:DEC0 MODE:0: access overflow\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"sound/soc/codecs/lpass-tx-macro.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"c39667ddcfc516fee084e449179d54430a558298\",\"lessThan\":\"dbc81b518f6936131bfd858be71cd4295136809c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c39667ddcfc516fee084e449179d54430a558298\",\"lessThan\":\"f84f2c81d792cf1e65571108a3bdd2c29e09e995\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c39667ddcfc516fee084e449179d54430a558298\",\"lessThan\":\"48b76879f5bfc8584b99052510ac645c6ade8d2b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c39667ddcfc516fee084e449179d54430a558298\",\"lessThan\":\"2ed3601e9db08fbdb071bd3d7bd8f115d6d871b0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c39667ddcfc516fee084e449179d54430a558298\",\"lessThan\":\"b6baab796d11fb84c0e9444ffca91af5eab22c25\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c39667ddcfc516fee084e449179d54430a558298\",\"lessThan\":\"3ee3c26ceee562079596abc9bc3307dd56dab4ed\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c39667ddcfc516fee084e449179d54430a558298\",\"lessThan\":\"1ba381759e45d5d0442452cfa5c42e836191a568\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"sound/soc/codecs/lpass-tx-macro.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.218\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.185\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.154\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.106\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.47\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.10\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1ba381759e45d5d0442452cfa5c42e836191a568\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/2ed3601e9db08fbdb071bd3d7bd8f115d6d871b0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3ee3c26ceee562079596abc9bc3307dd56dab4ed\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/48b76879f5bfc8584b99052510ac645c6ade8d2b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b6baab796d11fb84c0e9444ffca91af5eab22c25\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/dbc81b518f6936131bfd858be71cd4295136809c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f84f2c81d792cf1e65571108a3bdd2c29e09e995\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-27T11:52:47+00:00",
      "cve": "CVE-2026-80583",
      "id": "CVE-2026-80583",
      "initial_release_date": "2026-08-26T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80583.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "low",
      "current_release_date": "2026-08-28T16:37:14Z",
      "cve": "CVE-2026-80583",
      "id": "CVE-2026-80583",
      "initial_release_date": "2026-08-28T16:37:14Z",
      "product_status:known_affected": "198",
      "product_status:known_not_affected": "155",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80583",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80583.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.