CVE-2026-80910: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-80910 Overview

CVE-2026-80910 is a Linux kernel vulnerability in the ASoC (ALSA System on Chip) lpass-wsa-macro codec driver. The EAR SPKR PA Gain control and four WSA RX* Mux controls are declared as enumerated types. However, their get and put callbacks access values through ucontrol->value.integer.value[0] (a long) instead of the correct ucontrol->value.enumerated.item[0] (an unsigned int). On 64-bit kernels built with CONFIG_SND_CTL_DEBUG, this pattern trips the element value sanity check and causes every read of these controls to fail with -EINVAL.

Critical Impact
Audio control reads fail with -EINVAL on affected 64-bit Linux kernels using the WSA macro codec, breaking audio functionality on Qualcomm-based platforms.

Affected Products

Linux kernel builds including the sound/soc/codecs/lpass-wsa-macro.c driver
64-bit kernel configurations with CONFIG_SND_CTL_DEBUG enabled
Qualcomm-based platforms using the LPASS WSA macro codec

Discovery Timeline

2026-09-04 - CVE-2026-80910 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80910

Vulnerability Analysis

The issue exists in the lpass-wsa-macro ASoC codec driver within the Linux kernel sound subsystem. The driver defines several ALSA controls as SOC_ENUM types, including EAR SPKR PA Gain and four WSA RX* Mux controls. Enumerated ALSA controls must access user-supplied values through the value.enumerated.item[] member of the snd_ctl_elem_value union, which is typed as unsigned int.

The affected callbacks instead read and write through value.integer.value[], which is typed as long. On 64-bit systems, long occupies eight bytes while unsigned int occupies four, producing a type and size mismatch during access. When CONFIG_SND_CTL_DEBUG is enabled, the ALSA core performs sanity checks that detect the mismatch and reject every read of the affected controls with -EINVAL.

The same defect was previously corrected in sibling drivers via commit bcfe5f76cc40 for rx-macro and commit 0ea5eff7c606 for va-macro. The wsa-macro driver was overlooked during those earlier fixes.

Root Cause

The root cause is an incorrect union member access in kernel ALSA control callbacks. Enumerated controls require access through ucontrol->value.enumerated.item[0], but the driver uses ucontrol->value.integer.value[0]. This mismatch between the declared control type and the accessor member violates the ALSA control API contract.

Attack Vector

The defect is a functional and reliability bug rather than a remotely exploitable flaw. There is no known exploitation vector granting privilege escalation or code execution. Impact is limited to denial of audio functionality on affected devices when the debug configuration is present. Refer to the upstream commits for the exact patch content.

// No verified exploitation code available.
// See kernel git commits referenced below for the corrective patch.

Detection Methods for CVE-2026-80910

Indicators of Compromise

Kernel log messages reporting -EINVAL returns from ALSA control reads on EAR SPKR PA Gain or WSA RX* Mux controls
Userspace audio applications failing to enumerate or query WSA macro codec controls on Qualcomm platforms
ALSA control sanity check warnings emitted when CONFIG_SND_CTL_DEBUG is enabled

Detection Strategies

Inspect running kernel version and confirm whether the lpass-wsa-macro driver includes the fixes referenced in the upstream commits
Query control values with amixer or alsactl against the WSA macro codec and check for -EINVAL failures
Review kernel build configuration for CONFIG_SND_CTL_DEBUG=y on 64-bit ARM platforms using LPASS audio

Monitoring Recommendations

Monitor dmesg output for ALSA control validation errors on affected Qualcomm hardware
Track kernel package versions across the fleet and compare against stable branches carrying the fix
Alert on repeated audio subsystem initialization failures in system telemetry

How to Mitigate CVE-2026-80910

Immediate Actions Required

Update to a Linux kernel release that includes the upstream fix from the referenced stable commits
Identify Qualcomm-based systems that ship with the lpass-wsa-macro driver and prioritize their kernel updates
Validate audio control behavior after patching by exercising the affected mixer controls

Patch Information

The fix has been merged into the Linux stable tree across multiple branches. Reference commits include Kernel Git Commit 2fe7a89, Kernel Git Commit 4bcac4bf, Kernel Git Commit 524aa7b9, Kernel Git Commit 56f24311, Kernel Git Commit 7bcdde41, Kernel Git Commit 891129df, and Kernel Git Commit bd4e5f9c. The corrective change updates the get and put callbacks to use ucontrol->value.enumerated.item[0].

Workarounds

Disable CONFIG_SND_CTL_DEBUG in the kernel configuration to bypass the sanity check that surfaces the fault
Avoid direct userspace access to the affected mixer controls until the kernel is patched
Backport the referenced commits into custom kernel trees that cannot immediately move to a fixed stable release

bash

# Verify installed kernel version and check for the fixed driver
uname -r
modinfo snd-soc-lpass-wsa-macro | grep -E 'filename|version'

# Test whether affected controls return values without -EINVAL
amixer -c 0 contents | grep -E 'EAR SPKR PA Gain|WSA RX'