Executive brief
The Linux kernel's cs42l43 audio codec driver failed to validate that loaded firmware is large enough before dereferencing it as a data structure, potentially causing a system crash or undefined behavior. This affects systems with cs42l43 hardware that depend on the kernel to safely load device firmware.
Technical details
The vulnerability is an out-of-bounds memory access (CWE-125) in the cs42l43 driver's firmware loading routine. The code checked whether a firmware blob was received but did not verify that its size exceeded the firmware header structure. When the firmware pointer was cast and dereferenced as a header structure pointer without this length check, an undersized or malformed firmware could cause out-of-bounds memory access. The fix adds a size sanity check (`firmware->size < sizeof(*hdr)`) before dereferencing the firmware pointer. No authentication or network access is required; the vulnerability is triggered during local firmware loading operations on systems with this hardware.
Affected products
- Linux Linux kernel affected versions prior to fix commit b6ef1a74b3ec254f87a6a3c554fe8f8083ebd37c
Timeline
- 2026-08-28: disclosed
- 2026-05-08: patched: Upstream fix committed by Charles Keepax