CVE-2026-80583

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-80583", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-26T14:34:25.769Z", "datePublished": "2026-08-26T14:37:39.704Z", "dateUpdated": "2026-08-27T12:40:21.902Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-27T12:40:21.902Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses\n\nThe \"DEC0 MODE\" to \"DEC7 MODE\" controls are enumerated, but\ntx_macro_dec_mode_get() and tx_macro_dec_mode_put() access their\nvalue through ucontrol->value.integer.value[0] (a long) instead of\nucontrol->value.enumerated.item[0] (an unsigned int).\n\nThis same pattern was fixed in the sibling drivers by\ncommit bcfe5f76cc40 (\"ASoC: codecs: rx-macro: fix accessing array\nout of bounds for enum type\") and\ncommit 0ea5eff7c606 (\"ASoC: codecs: va-macro: fix accessing array\nout of bounds for enum type\"), but tx-macro was missed.\n\nOn 64-bit kernels built with CONFIG_SND_CTL_DEBUG, the elem value\nsanity check catches the 4 bytes written past the enumerated item\nand every read of these controls fails with -EINVAL:\n\n snd-sm8250 sound: control 2:0:0:DEC0 MODE:0: access overflow"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires local SNDRV_CTL_IOCTL_ELEM_READ or SNDRV_CTL_IOCTL_ELEM_WRITE on /dev/snd/controlC* through snd_ctl_ioctl() to tx_macro_dec_mode_get/put(); the Qualcomm LPASS TX macro audio codec driver has no network, Bluetooth, or physical-input attack path.\nAC:L - A single ioctl targeting DEC0-7 MODE deterministically triggers the 8-byte integer access against a 4-byte enumerated field on 64-bit kernels; the attacker controls both sides with no race, timing, or memory-layout dependency.\nPR:L - snd_ctl_open() performs no capability check; exploitation needs only local access to /dev/snd/controlC*, typically granted to the audio group on Qualcomm sc8250/sc8280 Chromebooks and Linux dev boards where this driver is present, not real root.\nUI:N - Once the attacker has ALSA control-device access they issue elem read/write ioctls themselves to DEC MODE controls; no separate victim action such as plugging hardware or opening a file is required.\nS:U - The out-of-bounds ctl-value access and resulting microphone ADC mode corruption remain within the host kernel and Qualcomm audio subsystem; there is no crossing of VM, container, or IOMMU security boundaries.\nC:H - tx_macro_dec_mode_put() reads ucontrol->value.integer.value[0] (8 bytes) for ENUM controls, performing a 4-byte out-of-bounds read past enumerated.item[0]; per kernel CVSS guidance out-of-bounds reads are scored High even when bounded.\nI:H - tx_macro_dec_mode_get() writes 8 bytes via integer.value[0], overflowing enumerated.item[0] by 4 bytes in kernel memory; put stores values into tx->dec_mode[] that program CDC_TXn_ADC_MODE on phone/Chromebook microphones, constituting memory corruption scored High.\nA:H - With CONFIG_SND_CTL_DEBUG every DEC0-7 MODE read fails with -EINVAL (access overflow), denying microphone ADC queries; on production 64-bit aarch64 builds the 4-byte union overrun corrupts ctl values and can break Qualcomm LPASS TX audio capture availability."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/soc/codecs/lpass-tx-macro.c"], "versions": [{"version": "c39667ddcfc516fee084e449179d54430a558298", "lessThan": "dbc81b518f6936131bfd858be71cd4295136809c", "status": "affected", "versionType": "git"}, {"version": "c39667ddcfc516fee084e449179d54430a558298", "lessThan": "f84f2c81d792cf1e65571108a3bdd2c29e09e995", "status": "affected", "versionType": "git"}, {"version": "c39667ddcfc516fee084e449179d54430a558298", "lessThan": "48b76879f5bfc8584b99052510ac645c6ade8d2b", "status": "affected", "versionType": "git"}, {"version": "c39667ddcfc516fee084e449179d54430a558298", "lessThan": "2ed3601e9db08fbdb071bd3d7bd8f115d6d871b0", "status": "affected", "versionType": "git"}, {"version": "c39667ddcfc516fee084e449179d54430a558298", "lessThan": "b6baab796d11fb84c0e9444ffca91af5eab22c25", "status": "affected", "versionType": "git"}, {"version": "c39667ddcfc516fee084e449179d54430a558298", "lessThan": "3ee3c26ceee562079596abc9bc3307dd56dab4ed", "status": "affected", "versionType": "git"}, {"version": "c39667ddcfc516fee084e449179d54430a558298", "lessThan": "1ba381759e45d5d0442452cfa5c42e836191a568", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/soc/codecs/lpass-tx-macro.c"], "versions": [{"version": "5.12", "status": "affected"}, {"version": "0", "lessThan": "5.12", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.218", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.185", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.154", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.106", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.47", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.10", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "5.15.218"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.1.185"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.6.154"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.12.106"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.18.47"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "7.1.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/dbc81b518f6936131bfd858be71cd4295136809c"}, {"url": "https://git.kernel.org/stable/c/f84f2c81d792cf1e65571108a3bdd2c29e09e995"}, {"url": "https://git.kernel.org/stable/c/48b76879f5bfc8584b99052510ac645c6ade8d2b"}, {"url": "https://git.kernel.org/stable/c/2ed3601e9db08fbdb071bd3d7bd8f115d6d871b0"}, {"url": "https://git.kernel.org/stable/c/b6baab796d11fb84c0e9444ffca91af5eab22c25"}, {"url": "https://git.kernel.org/stable/c/3ee3c26ceee562079596abc9bc3307dd56dab4ed"}, {"url": "https://git.kernel.org/stable/c/1ba381759e45d5d0442452cfa5c42e836191a568"}], "title": "ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["sound/soc/codecs/lpass-tx-macro.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "dbc81b518f6936131bfd858be71cd4295136809c", "status": "affected", "version": "c39667ddcfc516fee084e449179d54430a558298", "versionType": "git"}, {"lessThan": "f84f2c81d792cf1e65571108a3bdd2c29e09e995", "status": "affected", "version": "c39667ddcfc516fee084e449179d54430a558298", "versionType": "git"}, {"lessThan": "48b76879f5bfc8584b99052510ac645c6ade8d2b", "status": "affected", "version": "c39667ddcfc516fee084e449179d54430a558298", "versionType": "git"}, {"lessThan": "2ed3601e9db08fbdb071bd3d7bd8f115d6d871b0", "status": "affected", "version": "c39667ddcfc516fee084e449179d54430a558298", "versionType": "git"}, {"lessThan": "b6baab796d11fb84c0e9444ffca91af5eab22c25", "status": "affected", "version": "c39667ddcfc516fee084e449179d54430a558298", "versionType": "git"}, {"lessThan": "3ee3c26ceee562079596abc9bc3307dd56dab4ed", "status": "affected", "version": "c39667ddcfc516fee084e449179d54430a558298", "versionType": "git"}, {"lessThan": "1ba381759e45d5d0442452cfa5c42e836191a568", "status": "affected", "version": "c39667ddcfc516fee084e449179d54430a558298", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["sound/soc/codecs/lpass-tx-macro.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.12"}, {"lessThan": "5.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.218", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.185", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.154", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.106", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.47", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses\n\nThe \"DEC0 MODE\" to \"DEC7 MODE\" controls are enumerated, but\ntx_macro_dec_mode_get() and tx_macro_dec_mode_put() access their\nvalue through ucontrol->value.integer.value[0] (a long) instead of\nucontrol->value.enumerated.item[0] (an unsigned int).\n\nThis same pattern was fixed in the sibling drivers by\ncommit bcfe5f76cc40 (\"ASoC: codecs: rx-macro: fix accessing array\nout of bounds for enum type\") and\ncommit 0ea5eff7c606 (\"ASoC: codecs: va-macro: fix accessing array\nout of bounds for enum type\"), but tx-macro was missed.\n\nOn 64-bit kernels built with CONFIG_SND_CTL_DEBUG, the elem value\nsanity check catches the 4 bytes written past the enumerated item\nand every read of these controls fails with -EINVAL:\n\n snd-sm8250 sound: control 2:0:0:DEC0 MODE:0: access overflow"}], "id": "CVE-2026-80583", "lastModified": "2026-08-27T13:18:40.937", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-26T15:17:14.437", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1ba381759e45d5d0442452cfa5c42e836191a568"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2ed3601e9db08fbdb071bd3d7bd8f115d6d871b0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3ee3c26ceee562079596abc9bc3307dd56dab4ed"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/48b76879f5bfc8584b99052510ac645c6ade8d2b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b6baab796d11fb84c0e9444ffca91af5eab22c25"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/dbc81b518f6936131bfd858be71cd4295136809c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f84f2c81d792cf1e65571108a3bdd2c29e09e995"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses", "id": "2524480", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524480"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses\nThe \"DEC0 MODE\" to \"DEC7 MODE\" controls are enumerated, but\ntx_macro_dec_mode_get() and tx_macro_dec_mode_put() access their\nvalue through ucontrol->value.integer.value[0] (a long) instead of\nucontrol->value.enumerated.item[0] (an unsigned int).\nThis same pattern was fixed in the sibling drivers by\ncommit bcfe5f76cc40 (\"ASoC: codecs: rx-macro: fix accessing array\nout of bounds for enum type\") and\ncommit 0ea5eff7c606 (\"ASoC: codecs: va-macro: fix accessing array\nout of bounds for enum type\"), but tx-macro was missed.\nOn 64-bit kernels built with CONFIG_SND_CTL_DEBUG, the elem value\nsanity check catches the 4 bytes written past the enumerated item\nand every read of these controls fails with -EINVAL:\nsnd-sm8250 sound: control 2:0:0:DEC0 MODE:0: access overflow", "A flaw was found in the Linux kernel, specifically within the lpass-tx-macro audio codec driver. This vulnerability arises from the driver's incorrect handling of certain control values, where it uses an improper data type for accessing enumerated kernel controls. This error can lead to a system instability on 64-bit kernels configured for debugging, causing attempts to read these controls to fail. The primary consequence is a denial of service, preventing legitimate operations related to the audio codec."], "name": "CVE-2026-80583", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-26T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-80583\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-80583\nhttps://lore.kernel.org/linux-cve-announce/2026082615-CVE-2026-80583-f4d2@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c39667ddcfc516fee084e449179d54430a558298,3ee3c26ceee562079596abc9bc3307dd56dab4ed)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c39667ddcfc516fee084e449179d54430a558298,1ba381759e45d5d0442452cfa5c42e836191a568)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.12"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.12)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.10,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-26T17:45:03.748949+00:00", "updated": "2026-08-27T10:00:04.599377+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-787"]}