CVE-2026-97910
Received Received - Intake

Buffer Overflow in Linux Kernel ASoC SPRD Driver

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ASoC: sprd: validate compress buffer sizes against fixed allocations sprd_platform_compr_open() allocates the stage 0 IRAM buffer (32K data area) and the stage 1 DDR buffer (2M data area) with fixed sizes, but sprd_platform_compr_copy() derives all copy lengths from the user controlled runtime->fragment_size and the write() count, never comparing them against the physical buffer sizes. The compress core only checks fragment_size * fragments for an u32 overflow in snd_compress_check_input(), so a local user can configure a logical buffer of up to ~4GB via SNDRV_COMPRESS_SET_PARAMS, far exceeding the fixed allocations. A fragment_size larger than the 32K IRAM data area makes the stage 0 copy_from_user() overflow past the IRAM allocation, and a buffer_size larger than the 2M DDR buffer makes the wrapping copy at the end of sprd_platform_compr_copy() write fully user controlled data past the buffer. No SNDRV_PCM_TRIGGER_START is needed, a write() in SETUP state reaches the copy callback directly. Reject parameters that do not fit into the fixed buffers in set_params(), and fix the advertised max fragment size: 128K never fitted into the 32K IRAM buffer. The caps values may have been carried over from the qdsp6 driver, which allocates its buffers according to the advertised maxima, unlike this driver. With 32K as max fragment size the advertised limits are self-consistent: 32K * 64 = 2M equals the DDR buffer size. Discovered by Atuin - Automated Vulnerability Discovery Engine.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97910
EUVD
EUVD-2026-86764

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the ASoC subsystem for Spreadtrum chips. The issue occurs when handling compressed audio buffers. The driver allocates fixed-size buffers (32K for IRAM and 2M for DDR) but does not validate user-controlled input sizes. A local attacker can set a buffer size up to 4GB, causing overflows in the IRAM buffer during copy operations and writing user-controlled data past the DDR buffer.

Detection Guidance

This vulnerability is specific to the Linux kernel's ASoC subsystem, particularly the sprd driver. Detection requires checking if your system uses the affected driver and kernel version. Inspect loaded kernel modules with lsmod | grep sprd. Check kernel version with uname -a. If vulnerable, the system may show buffer overflow errors in kernel logs.

Impact Analysis

This vulnerability allows a local user to cause memory corruption by writing data beyond allocated buffer limits. This could lead to system crashes, privilege escalation, or arbitrary code execution. The impact is limited to systems using the affected ASoC driver for Spreadtrum chips.

Mitigation Strategies

Apply the latest kernel patches from your distribution to fix the buffer size validation in the sprd driver. If patches are unavailable, disable the sprd audio driver module using rmmod sprd_*. Monitor kernel logs for buffer overflow warnings. Restrict unprivileged user access to audio device nodes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97910. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart