ASoC: dapm: Fix off-by-one check on the second enum channel
Summary
| CVE | CVE-2026-90068 |
|---|
| State | PUBLISHED |
|---|
| Assigner | Linux |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2026-09-17 17:16:55 UTC |
|---|
| Updated | 2026-09-17 17:16:55 UTC |
|---|
| Description | In the Linux kernel, the following vulnerability has been resolved:
ASoC: dapm: Fix off-by-one check on the second enum channel
The snd_soc_dapm_put_enum_double() rejects item[0] once it reaches
e->items, but it lets item[1] be equal to it. Both go on to
snd_soc_enum_item_to_val(), which indexes e->values with no bound of
its own, so an enum with a value table reads one element past the end.
The indexing arrived with the MUX consolidation, which relaxed the
item[1] check in the same hunk. The value MUX handler it deleted used
>= there, and the snd_soc_put_enum_double() in soc-ops.c still does.
Only adav80x pairs a value table with two shifts, and its second
channel looks accidental, but the control does report two values.
Writing three into it reads off the end of adav80x_mux_values. The
core catches that only under CONFIG_SND_CTL_INPUT_VALIDATION, which
defaults off. |
|---|
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|
| CNA |
Linux |
Linux |
affected 3727b4968453dbab8fe18f979d67285eb6b66801 57ab955bde747327fb2042516ae1b7192c30e881 git |
Not specified |
| CNA |
Linux |
Linux |
affected 3727b4968453dbab8fe18f979d67285eb6b66801 806fa4e1f2bf73c54bc4b6360790ecc69d095ca5 git |
Not specified |
| CNA |
Linux |
Linux |
affected 3727b4968453dbab8fe18f979d67285eb6b66801 496081b4edc1f6e662418831c5b14cddd8d7920c git |
Not specified |
| CNA |
Linux |
Linux |
affected 3727b4968453dbab8fe18f979d67285eb6b66801 faf539af1a595a26e5a081a4e512caee2bc2f4c5 git |
Not specified |
| CNA |
Linux |
Linux |
affected 3727b4968453dbab8fe18f979d67285eb6b66801 32fc048391112559c34cb88d13594546939a4cd6 git |
Not specified |
| CNA |
Linux |
Linux |
affected 3727b4968453dbab8fe18f979d67285eb6b66801 10a36512c21f861a03fba461a7ead09023df9c1b git |
Not specified |
| CNA |
Linux |
Linux |
affected 3727b4968453dbab8fe18f979d67285eb6b66801 55126ef66298e43c69f192acebae8c7cc0022cf6 git |
Not specified |
| CNA |
Linux |
Linux |
affected 3727b4968453dbab8fe18f979d67285eb6b66801 14511c9b54ceeeef487409d73947c89ee8563590 git |
Not specified |
| CNA |
Linux |
Linux |
affected 3.15 |
Not specified |
| CNA |
Linux |
Linux |
unaffected 3.15 semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 5.10.270 5.10.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 5.15.221 5.15.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.1.188 6.1.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.6.157 6.6.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.12.110 6.12.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.18.52 6.18.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 7.2.6 7.2.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 7.3-rc1 * original_commit_for_fix |
Not specified |
References
| Reference | Source | Link | Tags |
|---|
| git.kernel.org/stable/c/57ab955bde747327fb2042516ae1b7192c30e881 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/32fc048391112559c34cb88d13594546939a4cd6 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/806fa4e1f2bf73c54bc4b6360790ecc69d095ca5 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/55126ef66298e43c69f192acebae8c7cc0022cf6 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/496081b4edc1f6e662418831c5b14cddd8d7920c |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/faf539af1a595a26e5a081a4e512caee2bc2f4c5 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/10a36512c21f861a03fba461a7ead09023df9c1b |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/14511c9b54ceeeef487409d73947c89ee8563590 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.