In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: lpass-cpu: use DAI table index for playback constraints The DAI ID… (CVE-2026-98940)

The vulnerability in the Linux kernel ASoC qcom lpass-cpu driver stemmed from using the DAI ID, which is a hardware port ID and not necessarily the index in the variant->dai_driver array, to index the DAI driver table. On platforms with sparse DAI IDs, such as IPQ806x where the DAI ID is 4 but only one entry exists in the driver table, this caused out-of-bounds writes when configuring playback constraints with LPAIF_I2SCTL_MODE_QUAD01. The patch corrects this by using the loop index to update the current DAI's playback channel constraints while retaining the DAI ID only for hardware-port-specific playback mode indexing.

The vulnerability could cause out-of-bounds memory writes in the kernel driver, potentially leading to system instability or crashes. No information about exploitation in the wild or further impact is provided.

A fix has been applied to the Linux kernel source code to correct the indexing logic. Users should update to the fixed kernel version once available. Patch status is not explicitly confirmed in the provided data; check the Linux kernel vendor advisory or source repository for the official fix and update guidance.