CVE-2026-98940 - Vulnerability Details

- ASoC: qcom: lpass-cpu: use DAI table index for playback constraints

Description

In the Linux kernel, the following vulnerability has been resolved:

ASoC: qcom: lpass-cpu: use DAI table index for playback constraints

The DAI ID is a hardware port ID and is not necessarily the index of
the corresponding entry in variant->dai_driver.

When configuring a DAI with LPAIF_I2SCTL_MODE_QUAD01, the probe code
currently uses dai_id to index variant->dai_driver. This is incorrect
for platforms where DAI IDs are sparse. For example, the IPQ806x MI2S
DAI has ID 4 while it is the only entry in the DAI driver table. If
that DAI is configured for QUAD01 and probe reaches this branch, the
code writes beyond that single entry via dai_driver[4] instead of
updating the DAI being processed.

Use the loop index i when updating the current DAI's playback channel
constraints, while retaining dai_id for indexing the hardware-port
specific playback SD-line mode array.

This fixes the incorrect DAI table access for platforms where the DAI
ID does not match its position in the driver table.

Published: 2026-10-23

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A bug in the Linux kernel’s ASoC qcom lpass‑cpu driver uses the DAI (digital audio interface) ID as an array index when configuring playback constraints for the QUAD01 mode. Since the DAI ID is a hardware port identifier, it may not match the array position, causing the code to write beyond the bounds of the dai_driver table. This out‑of‑bounds write can corrupt kernel memory, potentially leading to a crash or, in the worst case, kernel code execution.

Affected Systems

All Linux kernel builds that include the ASoC qcom lpass‑cpu driver and run on platforms with sparse DAI IDs, for example IPQ806x MI2S devices. The vulnerability is triggered when the hardware is configured for LPAIF_I2SCTL_MODE_QUAD01 and the probe path uses the incorrect index.

Risk and Exploitability

The vulnerability results in a kernel memory corruption condition that could cause a crash or, in the worst case, kernel code execution. The CVSS score of 5.5 indicates moderate severity, and the EPSS score of < 1% shows a very low current exploitation probability. The flaw is not listed in the CISA KEV catalog. The attack vector is a local kernel‑level fault during driver initialization and does not require external network access.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`c223f41c1a52bfe10f1d3311679b1d1f9813e500`	affected	< c10823507a74d7474391c01121e3f59901b1789f
`c223f41c1a52bfe10f1d3311679b1d1f9813e500`	affected	< 63987bb73df65fb01245b5905b005aa47c1dd27a
`c223f41c1a52bfe10f1d3311679b1d1f9813e500`	affected	< 775df6a27e8433e2414124472938009b958f9a77
`c223f41c1a52bfe10f1d3311679b1d1f9813e500`	affected	< 6833f1893ac2ec40016c348779af63debf3700d2
`c223f41c1a52bfe10f1d3311679b1d1f9813e500`	affected	< 69d2b7a4c115181629eb14d800aecc3e7de3f7fb
`c223f41c1a52bfe10f1d3311679b1d1f9813e500`	affected	< f11336e6d3cd9e28e5cdf1cb8a6171e7c3eff4e4
`c223f41c1a52bfe10f1d3311679b1d1f9813e500`	affected	< ca51771c8efde5df05476ac98dd1b2af4e2b149f

Linux

affected

Version	Status	Constraints
`5.14`	affected	—
`0`	unaffected	< 5.14
`5.15.224`	unaffected	≤ 5.15.*
`6.1.191`	unaffected	≤ 6.1.*
`6.6.160`	unaffected	≤ 6.6.*
`6.12.113`	unaffected	≤ 6.12.*
`6.18.56`	unaffected	≤ 6.18.*
`7.2.10`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

100%

Version	Status	Scheme	Platform
`[c223f41c1a52bfe10f1d3311679b1d1f9813e500,775df6a27e8433e2414124472938009b958f9a77)`	affected	code_commit	—
`[c223f41c1a52bfe10f1d3311679b1d1f9813e500,6833f1893ac2ec40016c348779af63debf3700d2)`	affected	code_commit	—
`[c223f41c1a52bfe10f1d3311679b1d1f9813e500,69d2b7a4c115181629eb14d800aecc3e7de3f7fb)`	affected	code_commit	—
`[c223f41c1a52bfe10f1d3311679b1d1f9813e500,f11336e6d3cd9e28e5cdf1cb8a6171e7c3eff4e4)`	affected	code_commit	—
`[c223f41c1a52bfe10f1d3311679b1d1f9813e500,ca51771c8efde5df05476ac98dd1b2af4e2b149f)`	affected	code_commit	—

Linux

100%

Version	Status	Scheme	Platform
`5.14`	affected	generic	—
`[0,5.14)`	unaffected	generic	—
`[6.6.160,6.7.0)`	unaffected	semver	—
`[6.12.113,6.13.0)`	unaffected	semver	—
`[6.18.56,6.19.0)`	unaffected	semver	—
`[7.2.10,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[c223f41c1a52bfe10f1d3311679b1d1f9813e500,775df6a27e8433e2414124472938009b958f9a77)`	affected	code_commit	—
`[c223f41c1a52bfe10f1d3311679b1d1f9813e500,6833f1893ac2ec40016c348779af63debf3700d2)`	affected	code_commit	—
`[c223f41c1a52bfe10f1d3311679b1d1f9813e500,69d2b7a4c115181629eb14d800aecc3e7de3f7fb)`	affected	code_commit	—
`[c223f41c1a52bfe10f1d3311679b1d1f9813e500,f11336e6d3cd9e28e5cdf1cb8a6171e7c3eff4e4)`	affected	code_commit	—
`[c223f41c1a52bfe10f1d3311679b1d1f9813e500,ca51771c8efde5df05476ac98dd1b2af4e2b149f)`	affected	code_commit	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`5.14`	affected	generic	—
`[0,5.14)`	unaffected	generic	—
`[6.6.160,6.7.0)`	unaffected	semver	—
`[6.12.113,6.13.0)`	unaffected	semver	—
`[6.18.56,6.19.0)`	unaffected	semver	—
`[7.2.10,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the kernel patch from the commits referenced in the advisory, rebuilding or installing the updated kernel.
Reboot the system to load the patched kernel and ensure the fix takes effect.
If an updated kernel cannot be applied immediately, temporarily disable the QUAD01 configuration for the MI2S DAI to prevent the out‑of‑bounds write.

Generated by OpenCVE AI on October 29, 2026 at 22:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-9018-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9018-2	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00173.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/63987bb73df65fb01245b5905b005aa47c1dd27a
https://git.kernel.org/stable/c/6833f1893ac2ec40016c348779af63debf3700d2
https://git.kernel.org/stable/c/69d2b7a4c115181629eb14d800aecc3e7de3f7fb
https://git.kernel.org/stable/c/775df6a27e8433e2414124472938009b958f9a77
https://git.kernel.org/stable/c/c10823507a74d7474391c01121e3f59901b1789f
https://git.kernel.org/stable/c/ca51771c8efde5df05476ac98dd1b2af4e2b149f
https://git.kernel.org/stable/c/f11336e6d3cd9e28e5cdf1cb8a6171e7c3eff4e4
https://nvd.nist.gov/vuln/detail/CVE-2026-98940
https://www.cve.org/CVERecord?id=CVE-2026-98940

History

Fri, 30 Oct 2026 13:00:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/63987bb73df65fb01245b5905b005aa47c1dd27a https://git.kernel.org/stable/c/c10823507a74d7474391c01121e3f59901b1789f

Thu, 29 Oct 2026 20:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-20 CWE-788

Thu, 29 Oct 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-787
References		https://nvd.nist.gov/vuln/detail/CVE-2026-98940 https://www.cve.org/CVERecord?id=CVE-2026-98940
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 23 Oct 2026 21:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linux linux
Vendors & Products		Linux linux

Fri, 23 Oct 2026 17:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-20 CWE-788

Fri, 23 Oct 2026 12:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: lpass-cpu: use DAI table index for playback constraints The DAI ID is a hardware port ID and is not necessarily the index of the corresponding entry in variant->dai_driver. When configuring a DAI with LPAIF_I2SCTL_MODE_QUAD01, the probe code currently uses dai_id to index variant->dai_driver. This is incorrect for platforms where DAI IDs are sparse. For example, the IPQ806x MI2S DAI has ID 4 while it is the only entry in the DAI driver table. If that DAI is configured for QUAD01 and probe reaches this branch, the code writes beyond that single entry via dai_driver[4] instead of updating the DAI being processed. Use the loop index i when updating the current DAI's playback channel constraints, while retaining dai_id for indexing the hardware-port specific playback SD-line mode array. This fixes the incorrect DAI table access for platforms where the DAI ID does not match its position in the driver table.
Title		ASoC: qcom: lpass-cpu: use DAI table index for playback constraints
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/6833f1893ac2ec40016c348779af63debf3700d2 https://git.kernel.org/stable/c/69d2b7a4c115181629eb14d800aecc3e7de3f7fb https://git.kernel.org/stable/c/775df6a27e8433e2414124472938009b958f9a77 https://git.kernel.org/stable/c/ca51771c8efde5df05476ac98dd1b2af4e2b149f https://git.kernel.org/stable/c/f11336e6d3cd9e28e5cdf1cb8a6171e7c3eff4e4

Subscriptions

Linux Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-23T12:12:08.487Z

Updated: 2026-10-30T12:40:27.052Z

Reserved: 2026-09-25T10:25:14.381Z

Link: CVE-2026-98940

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-23T13:17:14.960

Modified: 2026-10-30T13:21:32.277

Link: CVE-2026-98940

Redhat

Severity : Moderate

Publid Date: 2026-10-23T12:12:08Z

Links: CVE-2026-98940 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-29T22:15:04Z

Weaknesses

CWE-787
Out-of-bounds Write

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object