Bug 2506803 (CVE-2026-64243)

Summary: CVE-2026-64243 kernel: Linux kernel: ASoC simple-mux out-of-bounds read and denial of service
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerability-draftAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Linux kernel's Advanced Linux Sound Architecture (ASoC) simple-mux audio codec. A local user or process with access to the ALSA sound control interface could exploit an incorrect bounds check in the `simple_mux_control_put()` function. This vulnerability allows an attacker to store an invalid mux state, which can lead to an out-of-bounds read, incorrect audio routing, or an invalid General Purpose Input/Output (GPIO) state. The primary impact of this flaw is a potential denial of service.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-24 16:04:15 UTC 
In the Linux kernel, the following vulnerability has been resolved:

ASoC: codecs: simple-mux: Fix enum control bounds check

simple_mux_control_put() rejects values greater than e->items, but
enum control values are zero based. For the two-entry mux used by this
driver, valid values are 0 and 1, so value 2 must be rejected as well.

Accepting e->items can store an invalid mux state, pass it to the GPIO
setter, and pass it on to the DAPM mux update path where it is used as
an index into the enum text array.

Use the same >= e->items check used by the ASoC enum helpers.
Comment 1 Mauro Matteo Cascella 2026-07-28 11:00:05 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026072442-CVE-2026-64243-3088@gregkh/T