In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses EAR SPKR PA Gain" and the four "WSA RX* Mux" controls are enumerated, but their get and put callbacks access the value through ucontrol->value.integer.value[0] (a long) instead of ucontrol->value.enumerated.item[0] (an unsigned int). This same pattern was fixed in the sibling drivers by commit bcfe5f76cc40 ("ASoC: codecs: rx-macro: fix accessing array out of bounds for enum type") and commit 0ea5eff7c606 ("ASoC: codecs: va-macro: fix accessing array out of bounds for enum type"), but wsa-macro was missed. On 64-bit kernels with CONFIG_SND_CTL_DEBUG this trips the elem value sanity check and every read of these controls fails with -EINVAL.

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

No data.

No data.

References
Link Providers
https://git.kernel.org/stable/c/2fe7a89b2b5b73be35c1e493d0246314ba54e427 cve-icon cve-icon
https://git.kernel.org/stable/c/4bcac4bf304a3ec746192e49a669c236aaf27dbf cve-icon cve-icon
https://git.kernel.org/stable/c/524aa7b9954b0a43dd13f71ecbbac52a151c326d cve-icon cve-icon
https://git.kernel.org/stable/c/56f24311fd5607588a47e44675195a9efb200f29 cve-icon cve-icon
https://git.kernel.org/stable/c/7bcdde412e6c744f6135e02b12a735e2e37b639f cve-icon cve-icon
https://git.kernel.org/stable/c/891129df5de79cd533ae335c6eab24df2ff2b0fd cve-icon cve-icon
https://git.kernel.org/stable/c/bd4e5f9c3b764dc0e2a5662f92d63d2f3767a78d cve-icon cve-icon
History

Fri, 04 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-129

Fri, 04 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses EAR SPKR PA Gain" and the four "WSA RX* Mux" controls are enumerated, but their get and put callbacks access the value through ucontrol->value.integer.value[0] (a long) instead of ucontrol->value.enumerated.item[0] (an unsigned int). This same pattern was fixed in the sibling drivers by commit bcfe5f76cc40 ("ASoC: codecs: rx-macro: fix accessing array out of bounds for enum type") and commit 0ea5eff7c606 ("ASoC: codecs: va-macro: fix accessing array out of bounds for enum type"), but wsa-macro was missed. On 64-bit kernels with CONFIG_SND_CTL_DEBUG this trips the elem value sanity check and every read of these controls fails with -EINVAL.
Title ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-04T17:19:21.079Z

Updated: 2026-09-04T17:19:21.079Z

Reserved: 2026-08-26T14:34:25.801Z

Link: CVE-2026-80910

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-04T18:18:00.783

Modified: 2026-09-04T18:18:00.783

Link: CVE-2026-80910

cve-icon Redhat

No data.