CVE-2026-90068

ASoC: dapm: Fix off-by-one check on the second enum channel

Published Sep 17, 2026 CVSS n/a EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

ASoC: dapm: Fix off-by-one check on the second enum channel

The snd_soc_dapm_put_enum_double() rejects item[0] once it reaches
e->items, but it lets item[1] be equal to it. Both go on to
snd_soc_enum_item_to_val(), which indexes e->values with no bound of
its own, so an enum with a value table reads one element past the end.

The indexing arrived with the MUX consolidation, which relaxed the
item[1] check in the same hunk. The value MUX handler it deleted used
>= there, and the snd_soc_put_enum_double() in soc-ops.c still does.

Only adav80x pairs a value table with two shifts, and its second
channel looks accidental, but the control does report two values.
Writing three into it reads off the end of adav80x_mux_values. The
core catches that only under CONFIG_SND_CTL_INPUT_VALIDATION, which
defaults off.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`3727b4968453dbab8fe18f979d67285eb6b66801`	affected	< 57ab955bde747327fb2042516ae1b7192c30e881
`3727b4968453dbab8fe18f979d67285eb6b66801`	affected	< 806fa4e1f2bf73c54bc4b6360790ecc69d095ca5
`3727b4968453dbab8fe18f979d67285eb6b66801`	affected	< 496081b4edc1f6e662418831c5b14cddd8d7920c
`3727b4968453dbab8fe18f979d67285eb6b66801`	affected	< faf539af1a595a26e5a081a4e512caee2bc2f4c5
`3727b4968453dbab8fe18f979d67285eb6b66801`	affected	< 32fc048391112559c34cb88d13594546939a4cd6
`3727b4968453dbab8fe18f979d67285eb6b66801`	affected	< 10a36512c21f861a03fba461a7ead09023df9c1b
`3727b4968453dbab8fe18f979d67285eb6b66801`	affected	< 55126ef66298e43c69f192acebae8c7cc0022cf6
`3727b4968453dbab8fe18f979d67285eb6b66801`	affected	< 14511c9b54ceeeef487409d73947c89ee8563590

Linux

affected

Version	Status	Constraints
`3.15`	affected	—
`0`	unaffected	< 3.15
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.52`	unaffected	≤ 6.18.*
`7.2.6`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[3727b4968453dbab8fe18f979d67285eb6b66801,57ab955bde747327fb2042516ae1b7192c30e881)`	affected	code_commit	—
`[3727b4968453dbab8fe18f979d67285eb6b66801,806fa4e1f2bf73c54bc4b6360790ecc69d095ca5)`	affected	code_commit	—
`[3727b4968453dbab8fe18f979d67285eb6b66801,496081b4edc1f6e662418831c5b14cddd8d7920c)`	affected	code_commit	—
`[3727b4968453dbab8fe18f979d67285eb6b66801,faf539af1a595a26e5a081a4e512caee2bc2f4c5)`	affected	code_commit	—
`[3727b4968453dbab8fe18f979d67285eb6b66801,32fc048391112559c34cb88d13594546939a4cd6)`	affected	code_commit	—
`[3727b4968453dbab8fe18f979d67285eb6b66801,10a36512c21f861a03fba461a7ead09023df9c1b)`	affected	code_commit	—
`[3727b4968453dbab8fe18f979d67285eb6b66801,55126ef66298e43c69f192acebae8c7cc0022cf6)`	affected	code_commit	—
`[3727b4968453dbab8fe18f979d67285eb6b66801,14511c9b54ceeeef487409d73947c89ee8563590)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`3.15`	affected	generic	—
`[0,3.15)`	unaffected	generic	—
`[5.10.270,5.11.0.0)`	unaffected	semver	—
`[5.15.221,5.16.0.0)`	unaffected	semver	—
`[6.1.188,6.2.0.0)`	unaffected	semver	—
`[6.6.157,6.7.0.0)`	unaffected	semver	—
`[6.12.110,6.13.0.0)`	unaffected	semver	—
`[6.18.52,6.19.0.0)`	unaffected	semver	—
`[7.2.6,7.3.0.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DLA	DLA-4841-1	linux security update
Debian DSA	DSA-6528-1	linux security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9091-1	Linux kernel (NVIDIA Tegra) vulnerabilities

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.216% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/10a36512c21f861a03fba461a7ead09023df9c1b
https://git.kernel.org/stable/c/14511c9b54ceeeef487409d73947c89ee8563590
https://git.kernel.org/stable/c/32fc048391112559c34cb88d13594546939a4cd6
https://git.kernel.org/stable/c/496081b4edc1f6e662418831c5b14cddd8d7920c
https://git.kernel.org/stable/c/55126ef66298e43c69f192acebae8c7cc0022cf6
https://git.kernel.org/stable/c/57ab955bde747327fb2042516ae1b7192c30e881
https://git.kernel.org/stable/c/806fa4e1f2bf73c54bc4b6360790ecc69d095ca5
https://git.kernel.org/stable/c/faf539af1a595a26e5a081a4e512caee2bc2f4c5

History

Sep 20, 2026 5:15 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-125

Sep 17, 2026 4:30 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ASoC: dapm: Fix off-by-one check on the second enum channel The snd_soc_dapm_put_enum_double() rejects item[0] once it reaches e->items, but it lets item[1] be equal to it. Both go on to snd_soc_enum_item_to_val(), which indexes e->values with no bound of its own, so an enum with a value table reads one element past the end. The indexing arrived with the MUX consolidation, which relaxed the item[1] check in the same hunk. The value MUX handler it deleted used >= there, and the snd_soc_put_enum_double() in soc-ops.c still does. Only adav80x pairs a value table with two shifts, and its second channel looks accidental, but the control does report two values. Writing three into it reads off the end of adav80x_mux_values. The core catches that only under CONFIG_SND_CTL_INPUT_VALIDATION, which defaults off.
Title		ASoC: dapm: Fix off-by-one check on the second enum channel
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/10a36512c21f861a03fba461a7ead09023df9c1b https://git.kernel.org/stable/c/14511c9b54ceeeef487409d73947c89ee8563590 https://git.kernel.org/stable/c/32fc048391112559c34cb88d13594546939a4cd6 https://git.kernel.org/stable/c/496081b4edc1f6e662418831c5b14cddd8d7920c https://git.kernel.org/stable/c/55126ef66298e43c69f192acebae8c7cc0022cf6 https://git.kernel.org/stable/c/57ab955bde747327fb2042516ae1b7192c30e881 https://git.kernel.org/stable/c/806fa4e1f2bf73c54bc4b6360790ecc69d095ca5 https://git.kernel.org/stable/c/faf539af1a595a26e5a081a4e512caee2bc2f4c5