Look up another CVE · open CVE-2026-74293 in the interactive tracker
CVE-2026-74293
ASoC: fsl: fsl_audmix: Validate written enum values
Published 2026-08-15 (2 months ago) by the Linux kernel CNA. Subsystem sound/soc. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-74293 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixed | 6.1.180-1 | Update the kernel and reboot. Fixed in 6.1.180-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.100-1 | Update the kernel and reboot. Fixed in 6.12.100-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
fsl_audmix_put_mix_clk_src() and fsl_audmix_put_out_src() convert the user-provided enum item with snd_soc_enum_item_to_val() before checking whether the item is within the enum's item count. The generic snd_soc_put_enum_double() helper performs that validation, but these callbacks use the converted value first: the clock-source path tests it with BIT(), and the output-source path indexes the prms transition table with it. Reject out-of-range enum items before converting them.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
sound/soc/fsl/fsl_audmix.c
- What this is
- FREESCALE SOC SOUND DRIVERSMAINTAINERS section matched on sound/soc/fsl/fsl* · linux-sound@vger.kernel.org · Maintained
- Kernel module
- snd_soc_fsl_audmix
Check it on the machine
grep -wE 'CONFIG_SND|CONFIG_SND_SOC|CONFIG_SND_SOC_FSL_AUDMIX' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w snd_soc_fsl_audmixPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.
- bookwormMnot built on amd64/amd64, amd64/cloud-amd64, amd64/rt/amd64, arm64/cloud-arm64, armhf/armmp, armhf/armmp-lpae, armhf/rt/armmp, i386/686, i386/686-pae, i386/rt/686-pae, ppc64el/powerpc64le
- trixieMnot built on amd64/amd64, amd64/cloud-amd64, amd64/rt/amd64, arm64/cloud-arm64, armel/rpi, armhf/armmp, armhf/armmp-lpae, armhf/rt/armmp, ppc64el/powerpc64le, ppc64el/powerpc64le-64k, riscv64/riscv64, s390x/s390x
- forky, sidMnot built on amd64/amd64, amd64/cloud-amd64, amd64/rt-amd64, arm64/cloud-arm64, armhf/armmp, armhf/armmp-lpae, loong64/loong64, ppc64el/powerpc64le, ppc64el/powerpc64le-64k, riscv64/riscv64, s390x/s390x
- M
- a module where it is built at all; some flavours do not build it
- Build switches
- CONFIG_SND, CONFIG_SND_SOC, CONFIG_SND_SOC_FSL_AUDMIX
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-15 (2 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.18%, higher than 6.6% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- sound/soc
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.2 | 5.10.261 | 7513831b90a3 |
| 5.2 | 5.15.212 | b4774a7da12b |
| 5.2 | 6.1.178 | 8fb4364eb494 |
| 5.2 | 6.6.145 | 0b10c6203e62 |
| 5.2 | 6.12.97 | b36d6d48faa6 |
| 5.2 | 6.18.40 | 0f1510e84d7b |
| 5.2 | 7.1.5 | 5b7a23c1ed04 |
| 5.2 | 7.2 | 3cd17e4e2871 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- Exploitation requires a local SNDRV_CTL_IOCTL_ELEM_WRITE to /dev/snd/controlC* for the fsl-audmix "Output Source" or "Mixing Clock Source" mixer controls; no network, Bluetooth, or physical-input path reaches these put callbacks.
- AC:LAttack complexity, low
- On default builds without CONFIG_SND_CTL_INPUT_VALIDATION, a single ioctl supplying an out-of-range enumerated.item[0] deterministically reaches the buggy snd_soc_enum_item_to_val()/prms[] indexing before snd_soc_put_enum_double() rejects the value; no race or uncontrollable state is needed.
- PR:LPrivileges required, low
- snd_ctl_open() and snd_ctl_elem_write() perform no capability or namespace checks; any local user with ordinary access to the ALSA control device (common on i.MX8QM/i.MX952 automotive/embedded systems via audio-group or seat ACLs) can trigger the vulnerable callbacks.
- UI:NUser interaction, none
- The attacker issues the control write from its own process after opening the control device; no separate victim action such as mounting a filesystem or opening a file is required.
- S:UScope, unchanged
- The flaw corrupts or misreads kernel data and programs on-chip AUDMIX MMIO within the same host kernel security authority; it does not cross a VM, IOMMU, or sandbox boundary.
- C:HConfidentiality impact, high
- Out-of-range enum indices are used to index the static prms[out_src][val] transition table and in BIT(val) before bounds checks, causing out-of-bounds reads of kernel rodata that are copied into transition state and can disclose adjacent memory contents.
- I:HIntegrity impact, high
- Attacker-chosen indices can select unintended prms transition cells or out-of-bounds prm data that pass fsl_audmix_state_trans() and drive snd_soc_component_update_bits() to write attacker-influenced mask/ctr values into AUDMIX hardware control registers.
- A:HAvailability impact, high
- Large enum values can provoke undefined BIT() shifts, read past the prms table boundary, and program invalid AUDMIX control-register states that can kernel-fault or hang the audio subsystem; conservative scoring treats this memory-corruption class as high availability impact.