High 7.8Published Aug 26, 2026

CVE-2026-80526ASoC: tas2562: Validate values for volume writes

Updated under an hour ago (Oct 27, 2026, 10:30 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ASoC: tas2562: Validate values for volume writes tas2562_volume_control_put() does not do any validation of the control value written by userspace, it uses it to look up a value in a fixed size array which can easily be overflowed and then writes whatever value it gets back to the device. Add validation that we are loading a value we have in the array.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Aug 27, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from bf726b1c86f2caab70ad614cdf7da3b81ad08e69 before 1f389ecd0c35e9e281036e44c121df904f3164c1; from bf726b1c86f2caab70ad614cdf7da3b81ad08e69 before 20bdbb1376457ecbf418bf677fd285820d1fc011; from bf726b1c86f2caab70ad614cdf7da3b81ad08e69 before db488d653d896fcf9ac87e15239924c2928bbc3c; from bf726b1c86f2caab70ad614cdf7da3b81ad08e69 before c37a0461c0d0a70c5de4fdbd70449a7f53c12dda; from bf726b1c86f2caab70ad614cdf7da3b81ad08e69 before 8fb41964f7e4e4207c8999af2056894caa7a252a	CNA record

References

References

https://git.kernel.org/stable/c/1f389ecd0c35e9e281036e44c121df904f3164c1
https://git.kernel.org/stable/c/20bdbb1376457ecbf418bf677fd285820d1fc011
https://git.kernel.org/stable/c/db488d653d896fcf9ac87e15239924c2928bbc3c
https://git.kernel.org/stable/c/c37a0461c0d0a70c5de4fdbd70449a7f53c12dda
https://git.kernel.org/stable/c/8fb41964f7e4e4207c8999af2056894caa7a252a

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.