CVE-2026-80526: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-80526 Overview

CVE-2026-80526 is a Linux kernel vulnerability in the ALSA System-on-Chip (ASoC) driver for the Texas Instruments tas2562 audio amplifier. The tas2562_volume_control_put() function fails to validate control values written from userspace before using them as an index into a fixed-size lookup array. A local attacker with permission to write ALSA mixer controls can trigger an out-of-bounds read and cause the driver to send arbitrary values to the hardware. The Linux kernel maintainers resolved the flaw by adding bounds checking to ensure the supplied value maps to a valid array entry.

Critical Impact
Local, low-privileged access to the ALSA volume control can trigger an out-of-bounds array read in kernel context, leading to memory disclosure, driver instability, or writing arbitrary values to the tas2562 device.

Affected Products

Linux kernel builds that include the ASoC tas2562 codec driver
Distributions shipping the affected sound/soc/codecs/tas2562.c implementation prior to the fix
Embedded and mobile platforms integrating the Texas Instruments tas2562 amplifier

Discovery Timeline

2026-08-26 - CVE-2026-80526 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-80526

Vulnerability Analysis

The vulnerability resides in tas2562_volume_control_put() inside the ASoC codec driver for the Texas Instruments tas2562 Class-D audio amplifier. This callback handles writes to the ALSA mixer volume control from userspace tools such as amixer or alsactl. The function accepts an integer supplied by userspace and uses it as an index into a fixed-size lookup table without checking that the value falls within the table's bounds.

Because the lookup happens in kernel context, an oversized or negative index reads memory adjacent to the array. The driver then writes the resulting value back to the tas2562 device over I2C. This produces two distinct problems: kernel memory content leaks into hardware registers, and the device receives values outside its intended operating range. The fix adds validation to confirm the index corresponds to an entry actually present in the array.

Root Cause

The root cause is missing input validation on a userspace-controlled value used as an array index [Improper Input Validation]. The put handler trusts the value provided in the snd_ctl_elem_value structure and performs no bounds check before dereferencing the lookup array. This is a classic out-of-bounds read pattern in a kernel driver interface exposed to userspace.

Attack Vector

Exploitation requires local access with permission to write to the ALSA mixer control node, typically /dev/snd/controlC*. Access is commonly granted to members of the audio group or to any process running under a desktop session. An attacker issues a mixer write, for example through SNDRV_CTL_IOCTL_ELEM_WRITE, supplying an out-of-range integer for the volume control. The kernel driver then performs the out-of-bounds read and forwards the value to the hardware, without requiring elevated privileges or user interaction beyond the initial mixer write.

No public proof-of-concept exploit is currently referenced in NVD. See the upstream fix commits 1f389ec, 20bdbb1, 8fb4196, c37a046, and db488d6 for the exact code changes.

Detection Methods for CVE-2026-80526

Indicators of Compromise

Unexpected tas2562 audio driver errors, resets, or I2C write anomalies in dmesg and /var/log/kern.log
Non-audio processes issuing SNDRV_CTL_IOCTL_ELEM_WRITE ioctls against /dev/snd/controlC* device nodes
Kernel Address Sanitizer (KASAN) reports referencing tas2562_volume_control_put on instrumented builds

Detection Strategies

Audit mixer control writes with auditd rules on /dev/snd/control* to identify processes interacting with ALSA controls outside expected audio stacks
Enable KASAN on test and staging kernels to surface out-of-bounds accesses in the tas2562 driver during fuzzing or QA
Correlate audio subsystem kernel warnings with the running kernel version to identify unpatched hosts still exposed to this driver path

Monitoring Recommendations

Track kernel versions across the fleet and flag hosts running the tas2562 driver on pre-patch kernels
Monitor dmesg for repeated ASoC or tas2562 errors that may indicate abuse of the volume control interface
Alert on non-media user sessions that open ALSA control device nodes on servers or kiosks where audio activity is not expected

How to Mitigate CVE-2026-80526

Immediate Actions Required

Update to a Linux kernel release that includes the upstream commits listed in the references, or apply the vendor backport for your distribution
Restrict membership of the audio group and other groups with access to /dev/snd/control* to trusted users only
On systems that do not require the tas2562 amplifier, blacklist the snd-soc-tas2562 module through /etc/modprobe.d/ to remove the vulnerable code path

Patch Information

The fix adds validation in tas2562_volume_control_put() so that only indices present in the lookup array are accepted. The change is distributed across the upstream and stable trees in commits 1f389ec, 20bdbb1, 8fb4196, c37a046, and db488d6. Confirm your distribution vendor has picked up the backport for each supported stable branch before declaring hosts remediated.

Workarounds

Blacklist the snd-soc-tas2562 kernel module on systems that do not depend on the amplifier
Tighten permissions on /dev/snd/control* so only trusted audio service accounts can issue mixer writes
Remove interactive user access from embedded devices that expose the tas2562 driver but are not used for general-purpose computing

bash

# Blacklist the vulnerable module on hosts that do not require it
echo 'blacklist snd_soc_tas2562' | sudo tee /etc/modprobe.d/blacklist-tas2562.conf
sudo depmod -a

# Verify the module is not loaded
lsmod | grep tas2562

# Restrict access to ALSA control device nodes to the audio group
sudo chgrp audio /dev/snd/control*
sudo chmod 660 /dev/snd/control*