CVE-2026-80910
NoneCVSS
—
EPSS
0.2%
Published
Sep 4, 2026
CISA due date
—
Cloudanix analysis
A coding mistake in the Linux sound driver can make certain audio settings stop working on 64-bit systems that have extra debugging turned on.
- Exploitation
- Local Privilege
- Attacker needs
- Local User
- Complexity
- Theoretical
- Impact
- Denial Of Service
- Component
- OS kernel
- Class
- Other
- Remediation
- Patch
- Effort
- Low
- Patch risk
- Low
What it actually does
Incorrect kcontrol value access in lpass-wsa-macro driver uses integer.value[0] instead of enumerated.item[0] for enum controls, triggering elem value sanity checks and returning -EINVAL on every read under CONFIG_SND_CTL_DEBUG on 64-bit kernels.
Why it matters to the business
Audio configuration and playback controls can become unusable on affected systems, leading to operational disruptions for sound-dependent workloads until the kernel is updated.
How an attack unfolds
No active exploitation is known; the issue manifests during normal userspace interaction with the enumerated mixer controls rather than through malicious input crafted by an attacker.
How to fix it
Apply the upstream fix present in the commit that corrects the enum access pattern for the wsa-macro driver; rebuild and deploy the updated kernel.
How to confirm the fix worked
Confirm the corrected commit is present in the running kernel source and verify that reads of the EAR SPKR PA Gain and WSA RX* Mux controls no longer return -EINVAL when CONFIG_SND_CTL_DEBUG is enabled.
How to detect it
Review kernel logs and audit records for repeated EINVAL errors originating from snd_ctl_elem_read or the wsa-macro codec driver when userspace reads mixer controls; no external network or file-based indicators exist.
What your security team should do
- Prioritize kernel update for systems running audio codecs that expose these controls
- Monitor kernel logs for repeated -EINVAL returns from snd_ctl_elem_read during audio initialization
- Test audio subsystem functionality after patching to ensure mixer controls operate normally
The record
In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses EAR SPKR PA Gain" and the four "WSA RX* Mux" controls are enumerated, but their get and put callbacks access the value through ucontrol->value.integer.value[0] (a long) instead of ucontrol->value.enumerated.item[0] (an unsigned int). This same pattern was fixed in the sibling drivers by commit bcfe5f76cc40 ("ASoC: codecs: rx-macro: fix accessing array out of bounds for enum type") and commit 0ea5eff7c606 ("ASoC: codecs: va-macro: fix accessing array out of bounds for enum type"), but wsa-macro was missed. On 64-bit kernels with CONFIG_SND_CTL_DEBUG this trips the elem value sanity check and every read of these controls fails with -EINVAL.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|