A bug in the Linux kernel’s ASoC qcom lpass‑cpu driver uses the DAI (digital audio interface) ID as an array index when configuring playback constraints for the QUAD01 mode. Since the DAI ID is a hardware port identifier, it may not match the array position, causing the code to write beyond the bounds of the dai_driver table. This out‑of‑bounds write can corrupt kernel memory, potentially leading to a crash or, in the worst case, kernel code execution.

All Linux kernel builds that include the ASoC qcom lpass‑cpu driver and run on platforms with sparse DAI IDs, for example IPQ806x MI2S devices. The vulnerability is triggered when the hardware is configured for LPAIF_I2SCTL_MODE_QUAD01 and the probe path uses the incorrect index.

The vulnerability results in a kernel memory corruption condition. No publicly disclosed exploits exist and the EPSS score is not available, but the lack of bounds checking gives the flaw high severity. The issue is not listed in the CISA KEV catalog, yet any system that loads the affected kernel can be compromised if the flaw is triggered. The attack vector is a local kernel‑level fault that arises from normal driver initialization; it does not require external network exposure.