Skip to content
Fencer Intel
no cvss —

CVE-2026-98940 json

ASoC: qcom: lpass-cpu: use DAI table index for playback constraints

published 19d ago modified 12d ago also EUVD-2026-108912

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 6%
public exploits
0
none known

Summary

In the Linux kernel, the following vulnerability has been resolved:

ASoC: qcom: lpass-cpu: use DAI table index for playback constraints

The DAI ID is a hardware port ID and is not necessarily the index of the corresponding entry in variant->dai_driver.

When configuring a DAI with LPAIF_I2SCTL_MODE_QUAD01, the probe code currently uses dai_id to index variant->dai_driver. This is incorrect for platforms where DAI IDs are sparse. For example, the IPQ806x MI2S DAI has ID 4 while it is the only entry in the DAI driver table. If that DAI is configured for QUAD01 and probe reaches this branch, the code writes beyond that single entry via dai_driver[4] instead of updating the DAI being processed.

Use the loop index i when updating the current DAI's playback channel constraints, while retaining dai_id for indexing the hardware-port specific playback SD-line mode array.

This fixes the incorrect DAI table access for platforms where the DAI ID does not match its position in the driver table.

Patch / fix

  • Linux Linux 7.3
  • linux Debian 13 6.12.113-1
  • linux Debian 14 7.2.10-1

debian advisories DEBIAN-CVE-2026-98940

  • linux Ubuntu 24.04 LTS 6.8.0-149.149
  • linux Ubuntu 26.04 LTS 7.0.0-43.43
  • linux-aws Ubuntu 24.04 LTS 6.8.0-1069.74
  • linux-aws Ubuntu 26.04 LTS 7.0.0-1017.18
  • linux-gcp Ubuntu 24.04 LTS 6.8.0-1073.81
  • linux-gcp Ubuntu 26.04 LTS 7.0.0-1017.19
  • linux-gke Ubuntu 24.04 LTS 6.8.0-1068.77
  • linux-gke Ubuntu 26.04 LTS 7.0.0-1010.11

ubuntu advisories UBUNTU-CVE-2026-98940

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kernel-source Linux Micro 6.0 6.4.0-159998.55.1
  • kernel-default Linux Micro 6.0 6.4.0-159998.55.1
  • kernel-kvmsmall Linux Micro 6.0 6.4.0-159998.55.1
  • kernel-default-base Linux Micro 6.0 6.4.0-159998.55.1.159998.21.42
  • kernel-64kb SLE Module for Basesystem 15 SP7 6.4.0-150700.53.90.1
  • kernel-syms SLE Module for Development Tools 15 SP7 6.4.0-150700.53.90.1
  • kernel-azure SLE Module for Public Cloud 15 SP7 6.4.0-150700.53.90.1
  • kernel-source SLE Module for Development Tools 15 SP7, SLE Module for Basesystem 15 SP7 6.4.0-150700.53.90.1

suse advisories SUSE-SU-2026:24550-1SUSE-SU-2026:5091-1

Is CVE-2026-98940 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-98940 updated cvss 5.5

kernel: kernel: Denial of service via out-of-bounds write in Qualcomm LPASS driver

  • Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more Red Hat Enterprise Linux 10 kernel Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8, openshift/ose-rhel-coreos-9
    +1 more products
    Red Hat OpenShift Container Platform 5 openshift/ose-rhel-coreos-9
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.17% chance of exploitation in the next 30 days, higher than 6% of all scored CVEs (FIRST EPSS, 2026-11-11).

Affected products

  • Linux Linux

Classification

Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.