CVE-2026-98940 in Linux
Summary
by MITRE • 10/23/2026
In the Linux kernel, the following vulnerability has been resolved:
ASoC: qcom: lpass-cpu: use DAI table index for playback constraints
The DAI ID is a hardware port ID and is not necessarily the index of the corresponding entry in variant->dai_driver.
When configuring a DAI with LPAIF_I2SCTL_MODE_QUAD01, the probe code currently uses dai_id to index variant->dai_driver. This is incorrect for platforms where DAI IDs are sparse. For example, the IPQ806x MI2S DAI has ID 4 while it is the only entry in the DAI driver table. If that DAI is configured for QUAD01 and probe reaches this branch, the code writes beyond that single entry via dai_driver[4] instead of
updating the DAI being processed.
Use the loop index i when updating the current DAI's playback channel constraints, while retaining dai_id for indexing the hardware-port specific playback SD-line mode array.
This fixes the incorrect DAI table access for platforms where the DAI ID does not match its position in the driver table.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/23/2026
The Linux kernel audio subsystem contains a critical logic error within the Qualcomm Low Power Audio Subsystem CPU driver, specifically affecting how digital audio interface playback constraints are configured. This vulnerability stems from an incorrect assumption regarding the relationship between hardware port identifiers and software data structures. In this context, the Digital Audio Interface identifier serves as a unique hardware port ID assigned by the silicon design, which does not necessarily correspond to the sequential index of that entry within the variant-specific driver table maintained in memory. The probe routine for configuring audio interfaces incorrectly utilizes the raw DAI ID directly as an array index when accessing the dai_driver structure, leading to out-of-bounds memory access on platforms where these identifiers are sparse rather than contiguous.
The technical flaw manifests specifically during the configuration of Digital Audio Interfaces operating in LPAIF_I2SCTL_MODE_QUAD01 mode. When this specific operational mode is selected, the driver attempts to update playback channel constraints by writing to an array element indexed by the DAI ID. On platforms such as IPQ806x, where a particular MI2S interface might have a hardware identifier of four but occupies only the first position in the dai_driver table due to sparse allocation, this logic results in accessing index four instead of index zero. Consequently, the code writes beyond the bounds of the allocated array entry for the current DAI being processed. This represents a classic out-of-bounds write scenario where memory outside the intended structure is modified with potentially undefined or stale data from adjacent kernel structures.
From an operational impact perspective, this vulnerability poses significant risks to system stability and security during the device initialization phase. The immediate consequence of writing beyond array bounds is potential kernel panic or system crash if the out-of-bounds write corrupts critical control structures or triggers memory protection mechanisms such as KASAN. Furthermore, in more sophisticated exploitation scenarios, an attacker who can influence the DAI configuration parameters might leverage this buffer overflow to overwrite adjacent kernel memory. This could potentially lead to arbitrary code execution with kernel privileges, allowing for full system compromise. The vulnerability is particularly dangerous because it occurs during probe time, which may be triggered by user-space interactions or hardware enumeration processes that are not always strictly controlled.
This issue aligns with CWE-787: Out-of-bounds Write, as the root cause involves writing to a memory location outside the bounds of an allocated buffer due to incorrect index calculation. It also relates to CWE-1342: Off-by-One Error in terms of logic flow, although it is more accurately described as an off-base error where the offset used does not match the array size or structure layout. In the context of the MITRE ATT&CK framework for enterprise security, this type of vulnerability facilitates privilege escalation and execution on local systems, falling under techniques related to exploitation for initial access or persistence if combined with other vectors. The flaw highlights the importance of separating hardware identifiers from software indexing mechanisms in driver development.
To mitigate this risk, developers must ensure that array indices are derived from loop counters or explicit mapping tables rather than raw hardware IDs when those IDs do not guarantee contiguous allocation. In the specific case addressed by the fix, the solution involves using a local index variable for accessing the dai_driver table while retaining the DAI ID only for indexing into separate arrays where it correctly represents a port-specific parameter such as SD-line mode configurations. System administrators should apply kernel updates that include this patch to prevent potential instability or exploitation on affected Qualcomm-based platforms. Regular auditing of driver code for assumptions about hardware identifier continuity is essential to prevent similar vulnerabilities in other subsystems.