tas2562_volume_control_put() accepts a volume level supplied by userspace and uses it as an index into a fixed‑size array without validating the bounds. The unchecked index can exceed the array size, causing an out‑of‑bounds read and subsequently an out‑of‑bounds write to the TAS2562 audio codec. This memory corruption flaw is characterized by CWE-787. The effect is that an attacker can induce the driver to transmit malformed data, disrupting audio output or rendering the audio subsystem unusable, which constitutes a denial of service but does not provide arbitrary code execution.

The vulnerability resides in the Linux kernel’s Advanced Sound Architecture driver for the TAS2562 codec. All kernel releases that incorporate this driver without the reported patch are affected. No specific kernel version numbers are listed; the issue applies to any build that includes the unvalidated volume write code.

The flaw operates in kernel mode and requires local access to the ALSA interface to issue volume control operations. Based on the description, the attack vector is inferred to be local, needing write permission to the audio control files. The CVSS score of 7.8 reflects a high impact on availability. The EPSS score of < 1 % indicates a low probability of automated exploitation. The vulnerability is not listed in the CISA KEV catalogue, and no public exploits are documented. While it does not grant arbitrary code execution, it can be leveraged to cause service disruption.