CVE-2026-90068 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
ASoC: dapm: Fix off-by-one check on the second enum channel
The snd_soc_dapm_put_enum_double() rejects item[0] once it reaches
e->items, but it lets item[1] be equal to it. Both go on to
snd_soc_enum_item_to_val(), which indexes e->values with no bound of its own, so an enum with a value table reads one element past the end.
The indexing arrived with the MUX consolidation, which relaxed the item[1] check in the same hunk. The value MUX handler it deleted used
>= there, and the snd_soc_put_enum_double() in soc-ops.c still does.
Only adav80x pairs a value table with two shifts, and its second channel looks accidental, but the control does report two values. Writing three into it reads off the end of adav80x_mux_values. The core catches that only under CONFIG_SND_CTL_INPUT_VALIDATION, which defaults off.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel audio subsystem contains a critical out-of-bounds read vulnerability within the Digital Audio Interface Power Management component, specifically in the snd_soc_dapm_put_enum_double function. This flaw arises from an incorrect boundary check when handling dual-channel enumeration controls. The function is designed to validate user-supplied input values before applying them to hardware registers or internal state structures. However, the logic governing the second channel index fails to enforce a strict upper bound relative to the defined item count. While the first channel value is correctly rejected if it equals or exceeds the number of items in the enumeration table, the check for the second channel allows it to reach that same limit. This inconsistency creates an exploitable condition where valid input ranges are not uniformly enforced across both channels involved in a dual-channel control operation.
The technical consequence of this off-by-one error manifests during the subsequent processing phase when snd_soc_enum_item_to_val is invoked. This helper function maps enumeration indices to their corresponding integer values by accessing e->values array. Because the validation step permitted an index equal to the total item count, the resulting access reads one element past the end of the allocated value table. In C programming terms, this constitutes a classic out-of-bounds read vulnerability. Although the immediate impact is limited to reading uninitialized or adjacent memory data rather than writing to it, such behavior can lead to information disclosure if the leaked values contain sensitive kernel state or configuration details. Furthermore, depending on how these retrieved values are subsequently used by higher-level audio drivers, they could potentially influence control flow decisions in unexpected ways, although the primary risk remains unauthorized memory access.
The vulnerability specifically affects hardware drivers that utilize dual-channel enumeration controls with associated value tables. The adav80x codec driver is identified as a concrete example where this flaw can be triggered. In this scenario, the driver defines a mux configuration for two channels but only provides a single entry in its value table due to what appears to be an accidental oversight in the source code definition. Despite the logical redundancy of having two shifts with identical values, the control interface reports support for multiple items. When a user-space application or kernel component writes three distinct values into this control structure, triggering the second channel validation path results in reading beyond the adav80x_mux_values array boundary. This highlights how driver implementation errors can exacerbate core framework vulnerabilities, creating attack surfaces even when the underlying logic might seem benign due to redundant configurations.
From a security classification perspective, this issue aligns with CWE-125 Out-of-bounds Read and falls under MITRE ATT&CK technique T1083 File and Directory Discovery if used for information gathering within the kernel context. The vulnerability exists because of insufficient input validation during the processing of control parameters passed from user space to kernel space via ALSA controls. Under normal circumstances, CONFIG_SND_CTL_INPUT_VALIDATION is disabled by default in most distributions, meaning this bug remains latent and undetected during standard operation. However, when enabled for debugging or security auditing purposes, the core subsystem detects the invalid access attempt. This dependency on a non-default configuration option underscores the importance of enabling comprehensive input validation mechanisms in production environments to catch such logic errors before they can be exploited by malicious actors seeking to probe kernel memory boundaries.
Mitigation strategies primarily involve updating the Linux kernel to versions where this patch has been integrated, ensuring that snd_soc_dapm_put_enum_double correctly enforces strict less-than comparisons for both channel indices against e->items. For administrators unable to update immediately, disabling unnecessary audio controls or restricting access to ALSA control interfaces can reduce exposure. Developers maintaining custom kernels should audit their sound driver configurations, particularly those involving dual-channel muxes with value tables, to ensure that the number of defined items matches the expected range and that no redundant shifts create ambiguous validation paths. Long-term remediation requires enforcing consistent input validation logic across all similar enumeration handling functions in soc-ops.c and related subsystems to prevent recurrence of this class of boundary check errors.