In the Linux kernel ALSA ASoC driver for the lpass‑tx‑macro codec, the control values for DEC0 MODE through DEC7 MODE are accessed through the wrong data member: ucontrol->value.integer.value[0] (a long) instead of the proper ucontrol->value.enumerated.item[0] (an unsigned int). This mismatch causes an out‑of‑bounds write on 64‑bit kernels built with CONFIG_SND_CTL_DEBUG, forcing every subsequent read of these controls to fail with a -EINVAL error. The invalid memory write corrupts the expected enumeration access, preventing the sound controls from functioning correctly.

All Linux kernel releases that contain the lpass‑tx‑macro ASoC driver before the commit 1ba381759e45d5d0442452cfa5c42e836191a568 are vulnerable. The issue is limited to 64‑bit builds configured with CONFIG_SND_CTL_DEBUG and becomes apparent when the affected sound controls are queried. Any distribution shipping an older kernel with this driver and configuration is impacted until the kernel is patched.

The CVSS score of 7.8 indicates a high severity vulnerability. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating a modest level of publicly known exploitation. The bug manifests on 64‑bit kernels compiled with CONFIG_SND_CTL_DEBUG when the affected DEC0 MODE through DEC7 MODE controls are queried. The incorrect access writes past the end of the enumerated item array, causing the kernel’s sanity check to reject subsequent reads for these controls with an -EINVAL error. Consequently, the affected sound controls become unusable, effectively denying sound functionality for any user or process that requires them. The issue is local to systems that ship an older kernel with the lpass‑tx‑macro ASoC driver and the debug configuration enabled.