Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2016-2064: Linux kernel audio driver can crash with malformed app

CVE-2016-2064 · published 10 years ago

Summary

The audio driver used in Linux kernel version 3.x for Qualcomm devices can be tricked by a specially crafted application to read beyond its memory buffer, potentially causing the system to stop responding. This could lead to a temporary loss of audio functionality or a system freeze. Update the kernel to a version that includes the fix or apply the vendor’s patch to protect against the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
linux	linux_kernel	>= 3.0, <= 3.19.8 `cpe:2.3:o:linux:linux_kernel::::::::`

Original advisory text

sound/soc/msm/qdsp6v2/msm-audio-effects-q6-v2.c in the MSM QDSP6 audio driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted application that makes an ioctl call specifying many commands.

References

http://www.securityfocus.com/bid/92375 Third Party Advisory VDB Entry
https://us.codeaurora.org/cgit/quic/la/kernel/msm-3.18/commit/?id=775fca8289eff9... Mailing List Patch Third Party Advisory
https://www.codeaurora.org/multiple-vulnerabilities-msm-qdsp6-audio-driver-allow... Broken Link

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

7.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-125Out-of-bounds Read

Timeline

Published7 Aug 2016

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2016-2064 · NVD

Track software like this

Free during beta