CVE-2026-64243 in Linux
Summary
by MITRE • 07/24/2026
In the Linux kernel, the following vulnerability has been resolved:
ASoC: codecs: simple-mux: Fix enum control bounds check
simple_mux_control_put() rejects values greater than e->items, but enum control values are zero based. For the two-entry mux used by this driver, valid values are 0 and 1, so value 2 must be rejected as well.
Accepting e->items can store an invalid mux state, pass it to the GPIO setter, and pass it on to the DAPM mux update path where it is used as an index into the enum text array.
Use the same >= e->items check used by the ASoC enum helpers.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/24/2026
The vulnerability resides in the Linux kernel's Advanced Sound Architecture (ASoC) subsystem within the simple-mux codec driver implementation. This issue represents a classic boundary condition error that could lead to improper state management and potential system instability. The problem manifests when processing enumeration control values for audio muxing operations where the validation logic fails to properly account for zero-based indexing requirements inherent in enum controls.
The technical flaw occurs in the simple_mux_control_put() function which implements an incorrect bounds check against the enum items count. Specifically, the function accepts values up to and including e->items rather than strictly less than e->items as required by standard enumeration semantics. In a typical two-entry mux configuration, valid indices should be 0 and 1, making value 2 inherently invalid and potentially dangerous when processed through the system's GPIO setter and DAPM mux update pathways.
This vulnerability operates at the intersection of multiple kernel subsystems including audio device management, hardware abstraction layers, and device parameter validation. The improper validation allows an invalid mux state to be stored and subsequently propagated through the system's control flow paths. When this invalid state reaches the GPIO setter component, it can cause erroneous hardware configuration that may manifest as incorrect audio routing or complete audio subsystem failure. The vulnerability further compounds when the invalid value is passed to the DAPM (Dynamic Audio Power Management) mux update path where it serves as an array index into the enum text array.
The operational impact of this vulnerability extends beyond simple audio functionality degradation to potentially enabling more severe system stability issues. An attacker or faulty software component could manipulate audio controls to trigger the invalid state condition, leading to unpredictable behavior in audio device operation. This issue particularly affects systems utilizing the simple-mux codec driver where audio routing decisions are made through enumeration controls that must maintain strict index boundary validation.
The fix implemented addresses this vulnerability by adopting the same validation approach used by standard ASoC enum helper functions, specifically implementing a strict >= e->items check rather than the incorrect <= e->items comparison. This aligns the simple-mux implementation with established kernel patterns and security practices for enumeration validation. The resolution ensures that only valid zero-based enum indices are accepted, preventing the storage and propagation of invalid mux states through the audio subsystem's control paths. This change directly addresses CWE-129 Input Validation and CWE-787 Out-of-bounds Write vulnerabilities while maintaining compatibility with existing audio driver interfaces.
The mitigation strategy focuses on correcting the fundamental validation logic rather than implementing additional security layers, making it a straightforward fix that reduces attack surface without introducing complexity. This approach aligns with ATT&CK technique T1068, which involves privilege escalation through kernel-level vulnerabilities, by preventing unauthorized state manipulation that could lead to system instability or further exploitation opportunities. The resolution maintains backward compatibility while strengthening the audio subsystem's robustness against malformed control inputs and ensures proper adherence to the ASoC framework's expected behavior patterns for enum control handling.