Skip to main content

Linux Kernel CVE-2025-38486

MEDIUM
2025-07-28 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local vector confirmed by driver probe context; PR:L reflects minimum local access needed; pure availability impact as memory corruption causes kernel panic only.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
6.1 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 08:45 vuln.today
CVE Published
Jul 28, 2025 - 12:15 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

soundwire: Revert "soundwire: qcom: Add set_channel_map api support"

This reverts commit 7796c97df6b1b2206681a07f3c80f6023a6593d5.

This patch broke Dragonboard 845c (sdm845). I see:

Unexpected kernel BRK exception at EL1 Internal error: BRK handler: 00000000f20003e8 [#1] SMP pc : qcom_swrm_set_channel_map+0x7c/0x80 [soundwire_qcom] lr : snd_soc_dai_set_channel_map+0x34/0x78 Call trace: qcom_swrm_set_channel_map+0x7c/0x80 [soundwire_qcom] (P) sdm845_dai_init+0x18c/0x2e0 [snd_soc_sdm845] snd_soc_link_init+0x28/0x6c snd_soc_bind_card+0x5f4/0xb0c snd_soc_register_card+0x148/0x1a4 devm_snd_soc_register_card+0x50/0xb0 sdm845_snd_platform_probe+0x124/0x148 [snd_soc_sdm845] platform_probe+0x6c/0xd0 really_probe+0xc0/0x2a4 __driver_probe_device+0x7c/0x130 driver_probe_device+0x40/0x118 __device_attach_driver+0xc4/0x108 bus_for_each_drv+0x8c/0xf0 __device_attach+0xa4/0x198 device_initial_probe+0x18/0x28 bus_probe_device+0xb8/0xbc deferred_probe_work_func+0xac/0xfc process_one_work+0x244/0x658 worker_thread+0x1b4/0x360 kthread+0x148/0x228 ret_from_fork+0x10/0x20 Kernel panic - not syncing: BRK handler: Fatal exception

Dan has also reported following issues with the original patch https://lore.kernel.org/all/33fe8fe7-719a-405a-9ed2-d9f816ce1d57@sabinyo.mountain/

Bug #1: The zeroeth element of ctrl->pconfig[] is supposed to be unused. We start counting at 1. However this code sets ctrl->pconfig[0].ch_mask = 128.

Bug #2: There are SLIM_MAX_TX_PORTS (16) elements in tx_ch[] array but only QCOM_SDW_MAX_PORTS + 1 (15) in the ctrl->pconfig[] array so it corrupts memory like Yongqin Liu pointed out.

Bug 3: Like Jie Gan pointed out, it erases all the tx information with the rx information.

AnalysisAI

Kernel panic via memory corruption in the Qualcomm SoundWire driver affects Linux 6.16-rc1 through 6.16-rc6 on systems using Qualcomm SDM845 SoC (e.g., Dragonboard 845c). The faulty commit introduced three distinct bugs in qcom_swrm_set_channel_map: an off-by-one that clobbers pconfig[0], an out-of-bounds write due to mismatched array sizes (tx_ch[] has 16 entries but pconfig[] only 15), and RX data overwriting TX channel configuration - collectively triggering a BRK exception at EL1 and kernel panic during audio subsystem probe. No public exploit is identified and EPSS is 0.12%, consistent with a regression bug rather than an attacker-targeted vulnerability; the primary risk is system unavailability on affected hardware.

Technical ContextAI

The SoundWire subsystem in the Linux kernel provides a synchronous serial interface for audio devices, and the Qualcomm (qcom) SoundWire controller driver manages channel mapping between software DAIs and hardware ports. The reverted commit (7796c97df6b1b) introduced qcom_swrm_set_channel_map, which contained three compounding memory safety flaws: (1) accessing ctrl->pconfig[0] when the array is indexed from 1 by design, (2) iterating up to SLIM_MAX_TX_PORTS (16) elements into ctrl->pconfig[], which is only QCOM_SDW_MAX_PORTS+1 (15) elements wide - a classic off-by-one heap/stack corruption - and (3) overwriting the TX port configuration with RX data. The resulting memory corruption manifests as an unexpected BRK exception at EL1 during platform_probe of the sdm845 sound card, producing a kernel panic. Affected CPEs include cpe:2.3:o:linux:linux_kernel with 6.16-rc1 through 6.16-rc6, as well as an open-ended wildcard entry suggesting backport exposure. CWE classification is not formally assigned but the root cause class is CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) combined with CWE-193 (Off-by-One Error).

RemediationAI

Apply the upstream revert commits that remove the faulty qcom_swrm_set_channel_map implementation: https://git.kernel.org/stable/c/207cea8b72fcbdf4e6db178e54186ed4f1514b3c and https://git.kernel.org/stable/c/834bce6a715ae9a9c4dce7892454a19adf22b013. Distributions shipping 6.16-rc kernels or backporting the original broken commit (7796c97df6b1b) should apply these reverts immediately. As a workaround on affected SDM845 systems prior to patching, blacklisting the soundwire_qcom kernel module (modprobe.d blacklist soundwire_qcom) will prevent the driver from probing and thus prevent the kernel panic, though this disables SoundWire audio functionality entirely. No other compensating control can preserve audio functionality while avoiding the crash, given that the panic occurs during kernel driver initialization.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Server 16.1 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected

Share

CVE-2025-38486 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy