CVE-2026-80900

A flaw was found in the Linux kernel, specifically within the Advanced Linux Sound Architecture (ALSA) System on Chip (ASoC) SoundWire Digital Control Adapter (SDCA) component. This vulnerability arises from an improper validation of User Mode Protocol (UMP) message sizes. If a message offset exceeds the buffer's length, the size check fails to correctly identify the invalid size. This could potentially allow an attacker to cause system instability or a denial of service.

An improper size check in the ASoC SDCA UMP helpers can allow a message offset larger than the UMP buffer length to pass validation because the old expression subtracts msg_offset from buf_len before comparing msg_len. If the values are unsigned or otherwise wrap, sdca_ump_read_message or sdca_ump_write_message may operate beyond the intended UMP buffer boundary. For the CVSS the PR:L is used because a local user or local service with access to the ALSA or SDCA UMP interface may be able to trigger the helper once an affected device exposes a bad message offset. The issue is not network reachable and appears tied to local audio hardware or firmware controlled SDCA descriptors. Impact is at least denial of service and in the grounded worst case may include limited confidentiality or integrity impact from out of bounds UMP buffer access.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.