Executive brief
A vulnerability has been identified in the Linux kernel's audio subsystem affecting devices using the WCD937x audio codec. An error in how the system handles sound hardware ports could lead to memory corruption. If exploited, this could allow a local user to crash the system or potentially gain unauthorized access to sensitive data.
Technical details
A vulnerability exists in the ASoC wcd937x codec driver within the Linux kernel due to incorrect SoundWire port configuration for HPHL_COMP and HPHR_COMP. The driver incorrectly sets these ports to zero, which leads to an out-of-bounds access when the code attempts to index the -1 element of the port_map array. This memory corruption occurs during the execution of wcd937x_set_compander or wcd937x_get_compander. A local attacker with low privileges could exploit this to cause a kernel panic (DoS) or potentially achieve arbitrary code execution. The issue has been resolved in stable kernel branches by correctly assigning the WCD937X_COMP_L and WCD937X_COMP_R constants to the affected controls.
Affected products
- Linux Linux Kernel 6.11, 6.12.53, 6.17.3, 6.18
Timeline
- 2025-10-28: advisory: NVD publication date
- 2025-10-15: patched: Fix committed to stable kernel branches