tas2562_volume_control_put() accepts a control value from userspace without validating that it falls within the range of indices for a fixed‑size array. The unchecked index can exceed the array bounds, resulting in an out‑of‑bounds read that returns a garbage value, which is then written back to the device. This overflow path allows an attacker to influence the device state through arbitrary data that may otherwise be outside the permitted range, potentially leading to unexpected behavior of the audio subsystem or escalation of privileges if the kernel is compromised.

The vulnerability exists in the Linux kernel in the Advanced Sound Architecture (ASoC) driver for the tas2562 audio codec. All kernel releases that include this driver and have not yet been updated with the patch are affected. No specific versions are listed, so any current or older distribution kernel with this driver is potentially at risk until the vendor releases the fix.

Because the flaw is in kernel space, a successful exploitation can render a local attacker with root privileges or enable privilege escalation from a lower level. The EPSS score is not available, and the vulnerability is not currently listed in CISA's KEV catalog, so no public exploits are confirmed. However, the lack of array bounds checking and the ability to write arbitrary values to the device suggests that once the kernel has been updated, the exploitation complexity is moderate, provided the attacker has local access to the device or can influence the userspace driver calls.