The Linux kernel ASoC simple‑mux driver accepts enum control values larger than the declared number of items because the bounds test uses ">" instead of ">=". For a two‑entry mux the only valid values are 0 and 1, yet a value of 2 is also accepted and later used as an index into a text array and a GPIO setter. This mis‑indexing can corrupt kernel memory, trigger a kernel panic, or otherwise affect stability. The weakness is an improper input validation flaw (CWE‑20).

The flaw exists in the ASoC simple‑mux driver of the Linux kernel. Any kernel build that includes this driver without the recent patch is vulnerable. No specific version range is provided, so all kernels containing the unpatched implementation—whether older releases or custom builds with ASoC support—are affected.

The EPSS score is below 1 % and the issue is not listed in the CISA KEV catalog, indicating a low probability of widespread exploitation at present. With a CVSS score of 7.1 this flaw is considered high severity. Local attackers who can manipulate audio controls or load a malicious driver could trigger a kernel panic or cause a crash, warranting prompt remediation.