Executive brief
A vulnerability in the Linux kernel's audio driver components could allow a local user to cause a system crash or potentially access sensitive information. The issue stems from how the system handles internal configuration data for certain audio amplifiers. This could lead to operational disruptions or unauthorized data access on affected Linux systems.
Technical details
A memory safety issue exists in the Linux kernel's SPI driver for the CS42L43 audio codec. The software node property array in 'drivers/spi/spi-cs42l43.c' was not null-terminated, causing the downstream CS35L56 amplifier driver to read past the end of the allocated buffer into unknown memory. This out-of-bounds read occurs during node parsing because the software node does not specify an explicit entry count. A local attacker with low privileges could exploit this to cause a kernel fault (DoS) or potentially leak sensitive kernel memory. The issue has been patched by ensuring the property array is properly null-terminated using 'devm_kcalloc'.
Affected products
- Linux Linux Kernel 6.11 to 6.12.41, 6.13 to 6.15.9, 6.16 to 6.16.0
Timeline
- 2025-08-19: disclosed
- 2025-08-19: advisory