EUVD-2025-20906
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Lifecycle Timeline
4DescriptionNVD
In the Linux kernel, the following vulnerability has been resolved:
firmware: cs_dsp: Fix OOB memory read access in KUnit test
KASAN reported out of bounds access - cs_dsp_mock_bin_add_name_or_info(), because the source string length was rounded up to the allocation size.
AnalysisAI
CVE-2025-38340 is an out-of-bounds (OOB) memory read vulnerability in the Linux kernel's cs_dsp firmware module, specifically within the cs_dsp_mock_bin_add_name_or_info() KUnit test function. The vulnerability occurs when source string length is incorrectly rounded up during memory allocation, causing KASAN to detect out-of-bounds access. Local unprivileged users (PR:L) can trigger this vulnerability to read sensitive kernel memory, potentially disclosing confidential information or causing denial of service. This is a test/kernel development vulnerability with limited real-world impact as it resides in KUnit test code rather than production firmware paths.
Technical ContextAI
The cs_dsp (Cirrus Sound DSP) is a firmware handling module within the Linux kernel responsible for managing DSP firmware loading and interaction. The vulnerability exists in the KUnit test helper function cs_dsp_mock_bin_add_name_or_info(), which constructs mock binary firmware structures for unit testing. The root cause is a CWE-125 (Out-of-bounds Read) vulnerability where string length calculations fail to account for proper null-termination or allocation boundary checks. When the source string is rounded up to match the allocation size, the copy operation reads beyond the actual string data into adjacent memory. This impacts Linux kernel versions containing the affected cs_dsp module code, particularly in development/testing configurations where KUnit tests are enabled. The CPE context would be applicable to linux_kernel affected versions with cs_dsp firmware support (e.g., cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*).
RemediationAI
Patch: The vulnerability is resolved by correcting the string length calculation in cs_dsp_mock_bin_add_name_or_info() to prevent rounding up beyond the actual string boundary. The fix ensures proper bounds checking before memory access. Specific remediation steps: (1) Update Linux kernel to a patched version containing the cs_dsp OOB fix (consult kernel.org or your distribution's security advisories for exact versions); (2) For development systems, disable KUnit tests via CONFIG_KUNIT=n if not required; (3) If unable to patch immediately, restrict kernel module loading and disable KUnit test execution via boot parameters. Workarounds: Run production kernels without CONFIG_KUNIT enabled, as this disables the vulnerable test code path entirely. Mitigation: Enable kernel hardening features (KASAN, SMACK, SELinux) to detect and prevent exploitation attempts. Patch references: Monitor linux-kernel mailing list and kernel.org security advisories for official patch availability and affected version guidance.
Vendor StatusVendor
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | fixed | 5.10.223-1 | - |
| bullseye (security) | fixed | 5.10.251-1 | - |
| bookworm | fixed | 6.1.159-1 | - |
| bookworm (security) | fixed | 6.1.164-1 | - |
| trixie | fixed | 6.12.73-1 | - |
| trixie (security) | fixed | 6.12.74-2 | - |
| forky | fixed | 6.19.6-2 | - |
| sid | fixed | 6.19.8-1 | - |
| (unstable) | not-affected | - | - |
Share
External POC / Exploit Code
Leaving vuln.today