CVE-2026-74293 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
ASoC: fsl: fsl_audmix: Validate written enum values
fsl_audmix_put_mix_clk_src() and fsl_audmix_put_out_src() convert the user-provided enum item with snd_soc_enum_item_to_val() before checking whether the item is within the enum's item count.
The generic snd_soc_put_enum_double() helper performs that validation, but these callbacks use the converted value first: the clock-source path tests it with BIT(), and the output-source path indexes the prms transition table with it.
Reject out-of-range enum items before converting them.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability resides in the Freescale Audio Mixer driver component of the Linux kernel, specifically within the fsl_audmix subsystem that handles audio mixing operations for Freescale SoC platforms. The flaw manifests as a potential integer overflow and buffer overrun condition that occurs during enum value validation within two critical callback functions. The issue stems from improper ordering of validation steps where user-provided enum values are converted before being validated against acceptable ranges, creating a window for malicious input to cause unpredictable behavior in the audio subsystem.
The technical implementation flaw involves two primary callback functions fsl_audmix_put_mix_clk_src() and fsl_audmix_put_out_src() which process enum values for clock source and output source configurations respectively. These functions utilize snd_soc_enum_item_to_val() to convert user-supplied enum identifiers into internal integer representations before performing range validation checks. This conversion occurs prior to validation, allowing out-of-bounds enum items to be processed through BIT() operations in the clock-source path or array indexing operations in the output-source path. The vulnerability specifically enables attackers to provide enum values that exceed the defined item count boundaries, leading to potential memory corruption or unauthorized access patterns within the audio mixer's internal data structures.
The operational impact of this vulnerability extends beyond simple denial of service conditions to potentially enable privilege escalation or arbitrary code execution within the kernel space context. When out-of-range enum values are processed through BIT() operations, they may generate invalid bit masks that could corrupt adjacent memory locations or trigger unexpected behavior in the audio processing pipeline. Similarly, array indexing operations using invalid enum values can lead to buffer overflows when accessing the prms transition table, potentially allowing attackers to manipulate critical audio mixer parameters or access unauthorized memory regions. This vulnerability directly relates to CWE-129, which addresses insufficient validation of length of input buffers, and CWE-190, dealing with integer overflow or wraparound conditions.
Mitigation strategies should focus on implementing proper input validation ordering within the affected callback functions by ensuring that enum value ranges are validated before any conversion operations occur. The recommended solution involves modifying the function implementations to first verify that user-provided enum items fall within acceptable bounds using established validation mechanisms before applying snd_soc_enum_item_to_val() conversions. This approach aligns with ATT&CK technique T1068, which addresses exploit development for privilege escalation through kernel vulnerabilities, and follows security best practices outlined in the Linux kernel security documentation. Additionally, system administrators should ensure timely application of kernel updates containing the patched implementations to prevent exploitation of this vulnerability in production environments. The fix demonstrates proper defensive programming principles that prevent integer overflow conditions and maintain memory safety when processing user-supplied data within kernel space audio subsystems.