Executive brief
A memory corruption vulnerability was identified in the Linux kernel's SMA1307 audio codec driver, which is used to manage specific audio hardware components. The flaw occurs because the system incorrectly calculates the amount of memory needed to store configuration data, allocating only a fraction of the required space. An attacker with local access to the system could exploit this to crash the system or potentially gain unauthorized control over the operating system.
Technical details
The vulnerability is classified as an out-of-bounds write (CWE-787) within the sma1307_setting_loaded() function of the sound/soc/codecs/sma1307.c driver. The root cause is a size calculation error where devm_kzalloc() was called using a count of integers (header_size) as a byte count, resulting in an allocation four times smaller than required (assuming 32-bit integers). A subsequent memcpy() operation using the correct byte count (header_size * sizeof(int)) then overflows the allocated buffer. This local attack vector requires low privileges and no user interaction. The issue has been resolved by switching to devm_kmalloc_array(), which correctly handles the element size multiplication.
Affected products
- Linux Linux Kernel 6.13 to 6.16.8
Timeline
- 2025-08-29: patched: Initial patch authored by Dan Carpenter
- 2025-10-04: disclosed: CVE-2025-39935 published