Medium [CVE-2026-64243] Linux kernel: ASoC simple-mux out-of-bounds read and denial of service

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: simple-mux: Fix enum control bounds check simple_mux_control_put() rejects values greater than e->items, but enum control values are zero based. For the two-entry mux used by this driver, valid values are 0 and 1, so value 2 must be rejected as well.

Accepting e->items can store an invalid mux state, pass it to the GPIO setter, and pass it on to the DAPM mux update path where it is used as an index into the enum text array. Use the same >= e->items check used by the ASoC enum helpers.

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture (ASoC) simple-mux audio codec. A local user or process with access to the ALSA sound control interface could exploit an incorrect bounds check in the `simple_mux_control_put()` function.

This vulnerability allows an attacker to store an invalid mux state, which can lead to an out-of-bounds read, incorrect audio routing, or an invalid General Purpose Input/Output (GPIO) state. The primary impact of this flaw is a potential denial of service.

This flaw is rated with Moderate severity because exploitation demands local system access with permissions to manipulate ALSA sound controls, restricting the practical outcome primarily to denial of service through out-of-bounds kernel memory reads.