Skip to content
Heist/ feed
Unrated

ASoC: dapm: Fix off-by-one check on the second enum channel

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: ASoC: dapm: Fix off-by-one check on the second enum channel The snd_soc_dapm_put_enum_double() rejects item[0] once it reaches e->items, but it lets item[1] be equal to it. Both go on to snd_soc_enum_item_to_val(), which indexes e->values with no bound of its own, so an enum with a value table reads one element past the end. The indexing arrived with the MUX consolidation, which relaxed the item[1] check in the same hunk. The value MUX handler it deleted used >= there, and the snd_soc_put_enum_double() in soc-ops.c still does. Only adav80x pairs a value table with two shifts, and its second channel looks accidental, but the control does report two values. Writing three into it reads off the end of adav80x_mux_values. The core catches that only under CONFIG_SND_CTL_INPUT_VALIDATION, which defaults off.

Announced Source revision 1
Original source ↗

CVE-2026-90068

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-90068

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "3727b4968453dbab8fe18f979d67285eb6b66801",
        "lessThan": "57ab955bde747327fb2042516ae1b7192c30e881",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "3727b4968453dbab8fe18f979d67285eb6b66801",
        "lessThan": "806fa4e1f2bf73c54bc4b6360790ecc69d095ca5",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "3727b4968453dbab8fe18f979d67285eb6b66801",
        "lessThan": "496081b4edc1f6e662418831c5b14cddd8d7920c",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "3727b4968453dbab8fe18f979d67285eb6b66801",
        "lessThan": "faf539af1a595a26e5a081a4e512caee2bc2f4c5",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "3727b4968453dbab8fe18f979d67285eb6b66801",
        "lessThan": "32fc048391112559c34cb88d13594546939a4cd6",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "3727b4968453dbab8fe18f979d67285eb6b66801",
        "lessThan": "10a36512c21f861a03fba461a7ead09023df9c1b",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "3727b4968453dbab8fe18f979d67285eb6b66801",
        "lessThan": "55126ef66298e43c69f192acebae8c7cc0022cf6",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "3727b4968453dbab8fe18f979d67285eb6b66801",
        "lessThan": "14511c9b54ceeeef487409d73947c89ee8563590",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "sound/soc/soc-dapm.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "3.15"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "3.15",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "5.10.270",
        "versionType": "semver",
        "lessThanOrEqual": "5.10.*"
      },
      {
        "status": "unaffected",
        "version": "5.15.221",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.1.188",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.157",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.110",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.18.52",
        "versionType": "semver",
        "lessThanOrEqual": "6.18.*"
      },
      {
        "status": "unaffected",
        "version": "7.2.6",
        "versionType": "semver",
        "lessThanOrEqual": "7.2.*"
      },
      {
        "status": "unaffected",
        "version": "7.3",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "sound/soc/soc-dapm.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-90068

Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event
#36486 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement