CVE-2026-80583: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-80583 Overview

CVE-2026-80583 is a Linux kernel vulnerability in the ASoC (ALSA System on Chip) lpass-tx-macro codec driver. The driver mishandles enumerated kcontrol accesses for the DEC0 MODE through DEC7 MODE controls. The functions tx_macro_dec_mode_get() and tx_macro_dec_mode_put() read and write control state through ucontrol->value.integer.value[0] (a long) instead of ucontrol->value.enumerated.item[0] (an unsigned int). This causes writes past the bounds of the enumerated item field, an out-of-bounds write pattern previously fixed in sibling drivers rx-macro and va-macro.

Critical Impact
A local user with access to the ALSA control interface can trigger out-of-bounds kernel memory writes, and on kernels built with CONFIG_SND_CTL_DEBUG, every read of the affected controls fails with -EINVAL.

Affected Products

Linux kernel builds including the snd-soc-lpass-tx-macro driver
Qualcomm platforms using LPASS TX macro codec (for example, SM8250-based devices)
Distributions shipping the affected kernel versions prior to the fix commits

Discovery Timeline

2026-08-26 - CVE-2026-80583 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-80583

Vulnerability Analysis

The lpass-tx-macro driver exposes eight enumerated controls named DEC0 MODE through DEC7 MODE. ALSA kcontrol values are transported through a union snd_ctl_elem_value, and each control type must access the correct union member. Enumerated controls must use ucontrol->value.enumerated.item[0], which is an unsigned int. The affected functions instead access ucontrol->value.integer.value[0], which is a long. On 64-bit kernels a long is 8 bytes while unsigned int is 4 bytes, so writes overflow by 4 bytes into adjacent union storage.

The kernel's control element sanity check, enabled via CONFIG_SND_CTL_DEBUG, detects the overflow and rejects reads with -EINVAL, producing log lines such as snd-sm8250 sound: control 2:0:0:DEC0 MODE:0: access overflow. On production kernels without the debug option, the mismatched access remains latent and corrupts adjacent bytes of the value union.

Root Cause

The root cause is incorrect union member access in tx_macro_dec_mode_get() and tx_macro_dec_mode_put(). The controls are declared with SOC_ENUM_EXT, so the ALSA core treats them as enumerated. The handlers, however, treat the value as an integer. This is the same defect resolved in the sibling codecs by commits bcfe5f76cc40 (rx-macro) and 0ea5eff7c606 (va-macro); the fix for tx-macro was missed until this CVE.

Attack Vector

Exploitation requires local access with permission to open ALSA control device nodes, typically /dev/snd/controlC*. An attacker with such access invokes SNDRV_CTL_IOCTL_ELEM_WRITE against the affected DEC[0-7] MODE controls, triggering the out-of-bounds write into the value union. See the upstream fix at Kernel Commit 48b76879f5bf for the corrected accessors.

Detection Methods for CVE-2026-80583

Indicators of Compromise

Kernel log entries such as snd-sm8250 sound: control 2:0:0:DEC0 MODE:0: access overflow on kernels with CONFIG_SND_CTL_DEBUG enabled.
Repeated -EINVAL failures from userspace processes issuing SNDRV_CTL_IOCTL_ELEM_READ against DEC[0-7] MODE controls.
Unexpected processes opening /dev/snd/controlC* device nodes outside of standard audio subsystem daemons.

Detection Strategies

Monitor dmesg and journald for access overflow messages originating from the snd-soc-lpass-tx-macro driver.
Audit access to /dev/snd/controlC* using auditd path rules to identify non-audio processes touching ALSA control nodes.
Compare running kernel versions against the fixed commits listed in the upstream stable tree references.

Monitoring Recommendations

Enable CONFIG_SND_CTL_DEBUG on test kernels to surface the sanity-check message during triage or fleet validation.
Track kernel package versions across Qualcomm-based Linux devices to confirm that fixed builds are deployed.
Alert on kernel oops or memory corruption warnings correlated with audio subsystem activity.

How to Mitigate CVE-2026-80583

Immediate Actions Required

Update the Linux kernel to a stable release that contains the lpass-tx-macro enum kcontrol fix.
Restrict membership of the audio group and tighten permissions on /dev/snd/controlC* to trusted users only.
Inventory Qualcomm SoC-based Linux systems (for example, SM8250) to confirm exposure and patch status.

Patch Information

The fix replaces ucontrol->value.integer.value[0] with ucontrol->value.enumerated.item[0] inside tx_macro_dec_mode_get() and tx_macro_dec_mode_put(). Backports are available across multiple stable branches. Refer to the upstream commits: Commit 1ba381759e45, Commit 2ed3601e9db0, Commit 3ee3c26ceee5, Commit 48b76879f5bf, Commit b6baab796d11, Commit dbc81b518f69, and Commit f84f2c81d792.

Workarounds

Unload the snd-soc-lpass-tx-macro module on systems that do not require the TX macro codec until patches are applied.
Remove non-essential users from the audio group to limit who can open ALSA control interfaces.
Apply distribution-provided hotfix kernels as soon as they are available and reboot affected devices.

bash

# Verify installed kernel and reload audio stack after patching
uname -r
modinfo snd-soc-lpass-tx-macro | grep -E 'filename|version'
# Temporarily unload the affected module on non-audio workloads
sudo modprobe -r snd-soc-lpass-tx-macro
# Restrict access to ALSA control device nodes
sudo chmod 0660 /dev/snd/controlC*
sudo chown root:audio /dev/snd/controlC*