CVE-2026-64243 Overview
CVE-2026-64243 is a Linux kernel vulnerability in the ASoC (ALSA System on Chip) simple-mux codec driver. The simple_mux_control_put() function contains an incorrect bounds check that permits invalid enum control values to reach the GPIO setter and DAPM mux update path. The check rejects values greater than e->items but fails to reject values equal to e->items, since enum control values are zero-based. A local authenticated attacker can supply an out-of-range index that is later used to dereference the enum text array, leading to memory safety violations in the audio subsystem.
Critical Impact
A local user with access to the ALSA control interface can trigger out-of-bounds access in the kernel audio path, corrupting mux state and causing denial of service on affected systems.
Affected Products
- Linux kernel — ASoC simple-mux codec driver
- Distributions shipping vulnerable stable kernel branches prior to the referenced fix commits
- Embedded and audio-enabled Linux systems using the two-entry simple mux codec
Discovery Timeline
- 2026-07-24 - CVE-2026-64243 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-64243
Vulnerability Analysis
The flaw resides in simple_mux_control_put() within the ASoC codecs simple-mux driver. The function validates userspace-supplied enum control values before applying them to the GPIO mux state. The original check used a strict greater-than comparison against e->items, allowing a value exactly equal to e->items to pass validation. Because enum indices are zero-based, valid values range from 0 to e->items - 1. For the two-entry mux implemented by this driver, valid indices are 0 and 1, meaning the value 2 must also be rejected.
Accepting e->items as a valid value stores an invalid mux state in the control. The driver forwards that state to the GPIO setter and propagates it into the Dynamic Audio Power Management (DAPM) mux update path. DAPM then uses the value as an index into the enum text array, producing out-of-bounds memory access [CWE-125]. The fix aligns the driver with the standard ASoC enum helpers by using a >= e->items comparison.
Root Cause
The root cause is an off-by-one error in the bounds check inside simple_mux_control_put(). The condition tests for values strictly greater than the item count instead of greater-than-or-equal. Zero-based indexing requires the upper bound to be exclusive, matching the pattern used elsewhere in the ASoC subsystem.
Attack Vector
Exploitation requires local access with permission to write to the ALSA control interface associated with the simple-mux codec. An attacker calls the control put operation with an integer value equal to e->items. The invalid value bypasses the flawed check, reaches the GPIO layer, and is used as an array index in the DAPM update path. The result is out-of-bounds read behavior in kernel context, impacting confidentiality of adjacent kernel memory and availability of the audio subsystem.
No public proof-of-concept is available for CVE-2026-64243, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the upstream commit references for technical details, including kernel commit 05ef77f and kernel commit f63ad68.
Detection Methods for CVE-2026-64243
Indicators of Compromise
- Unexpected kernel warnings or oops messages referencing simple_mux_control_put, snd_soc_dapm_mux_update_power, or the ASoC DAPM stack.
- KASAN reports flagging out-of-bounds reads in ASoC enum text array accesses.
- Audio subsystem instability or repeated ALSA control write failures from unprivileged processes.
Detection Strategies
- Enumerate installed kernel versions across Linux endpoints and compare against the fixed stable branch commits referenced in the NVD advisory.
- Audit ALSA control write activity on systems using the simple-mux codec, particularly writes originating from non-audio service accounts.
- Enable KASAN on test kernels to catch the out-of-bounds access during pre-production validation.
Monitoring Recommendations
- Collect dmesg and journald kernel logs centrally and alert on ASoC or DAPM error patterns.
- Track process invocations of amixer, alsactl, and direct ioctl calls against /dev/snd/controlC* on production hosts.
- Monitor kernel package versions through configuration management to confirm patch coverage across fleets.
How to Mitigate CVE-2026-64243
Immediate Actions Required
- Apply the upstream Linux kernel patch that changes the bounds check to >= e->items in simple_mux_control_put().
- Update to a stable kernel release that incorporates one of the referenced fix commits and reboot affected systems.
- Restrict access to ALSA control device nodes to trusted users and audio service accounts only.
Patch Information
The fix is available in the mainline Linux kernel and backported across stable branches. Reference commits include 05ef77f0, 164dcbec, 2ff3ac6f, 5fe860af, 6fb653b6, d8cc3e74, and f63ad68e. See the Linux kernel stable tree for the corrected bounds check that mirrors the standard ASoC enum helpers.
Workarounds
- Unload the simple-mux codec module on systems that do not require it using modprobe -r snd-soc-simple-mux.
- Constrain ALSA device permissions so only members of the audio group can issue control writes to affected mux controls.
- Deploy SELinux or AppArmor policies to block unauthorized processes from opening /dev/snd/controlC* nodes.
# Configuration example: restrict ALSA control access and verify kernel version
sudo chgrp audio /dev/snd/controlC*
sudo chmod 0660 /dev/snd/controlC*
uname -r
modinfo snd-soc-simple-mux | grep -E 'filename|version'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
