Skip to main content

Linux Kernel EUVDEUVD-2025-20916

| CVE-2025-38330 HIGH
Out-of-bounds Read (CWE-125)
2025-07-10 416baaa9-dc9f-4396-8d5f-8c081fb06d67
7.1
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
SUSE
HIGH
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

4
EUVD ID Assigned
Mar 16, 2026 - 06:52 euvd
EUVD-2025-20916
Analysis Generated
Mar 16, 2026 - 06:52 vuln.today
Patch released
Mar 16, 2026 - 06:52 nvd
Patch available
CVE Published
Jul 10, 2025 - 09:15 nvd
HIGH 7.1

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

firmware: cs_dsp: Fix OOB memory read access in KUnit test (ctl cache)

KASAN reported out of bounds access - cs_dsp_ctl_cache_init_multiple_offsets(). The code uses mock_coeff_template.length_bytes (4 bytes) for register value allocations. But later, this length is set to 8 bytes which causes test code failures.

As fix, just remove the lenght override, keeping the original value 4 for all operations.

AnalysisAI

CVE-2025-38330 is an out-of-bounds memory read vulnerability in the Linux kernel's cs_dsp firmware driver, specifically within KUnit test code for control cache initialization. The vulnerability allows a local attacker with low privileges to read sensitive kernel memory, potentially leading to information disclosure and denial of service. This is a kernel testing/development issue rather than a production runtime vulnerability, with no evidence of active exploitation in the wild.

Technical ContextAI

The vulnerability exists in the linux kernel's cs_dsp (Cirrus Logic DSP) firmware subsystem, specifically in the cs_dsp_ctl_cache_init_multiple_offsets() function used during KUnit testing. The root cause is CWE-125 (Out-of-bounds Read) where mock coefficient template data allocated with a 4-byte length is later overridden to 8 bytes, causing subsequent memory accesses to read beyond allocated buffer boundaries. The cs_dsp driver is a kernel firmware loader for Cirrus Logic digital signal processors used in audio hardware. The vulnerability manifests in test code rather than production kernel code, affecting developers running kernel self-tests with KASAN (Kernel Address Sanitizer) enabled. CPE context: linux kernel versions containing the affected cs_dsp subsystem.

RemediationAI

Remove the length override in the mock_coeff_template initialization within the cs_dsp KUnit test, restoring the original 4-byte length value for all buffer allocation and access operations. Patch: Apply the Linux kernel commit that removes the problematic length field override in cs_dsp_ctl_cache_init_multiple_offsets(). Affected developers should: (1) Update to a patched Linux kernel version containing this fix; (2) Apply the specific commit to drivers/firmware/cirrus/cs_dsp.c if running custom kernel builds; (3) Run git log --grep='cs_dsp_ctl_cache' or similar to identify the exact patch commit. For production systems: compile kernel without CONFIG_KUNIT or CONFIG_KASAN if not needed for development, though these are typically disabled in production builds anyway.

CVE-2022-0847 HIGH POC
7.8 Mar 10

Linux kernel contains a flaw known as 'Dirty Pipe' where improper pipe buffer flag initialization allows unprivileged lo

CVE-2015-1328 HIGH POC
7.8 Nov 28

The overlayfs implementation in the linux (aka Linux kernel) package before 3.19.0-21.21 in Ubuntu through 15.04 does no

CVE-2017-7308 HIGH POC
7.8 Mar 29

The packet_set_ring function in net/packet/af_packet.c in the Linux kernel through 4.10.6 does not properly validate cer

CVE-2017-16995 HIGH POC
7.8 Dec 27

The check_alu_op function in kernel/bpf/verifier.c in the Linux kernel through 4.4 allows local users to cause a denial

CVE-2017-1000112 HIGH POC
7.0 Oct 05

Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. Rated high severity (CVSS 7.0). Public ex

CVE-2015-8660 MEDIUM POC
6.7 Dec 28

The ovl_setattr function in fs/overlayfs/inode.c in the Linux kernel through 4.3.3 attempts to merge distinct setattr op

CVE-2012-0056 MEDIUM POC
6.9 Jan 27

The mem_write function in the Linux kernel before 3.2.2, when ASLR is disabled, does not properly check permissions when

CVE-2014-0038 MEDIUM POC
6.9 Feb 06

The compat_sys_recvmmsg function in net/compat.c in the Linux kernel before 3.13.2, when CONFIG_X86_X32 is enabled, allo

CVE-2016-8655 HIGH POC
7.8 Dec 08

Race condition in net/packet/af_packet.c in the Linux kernel through 4.8.12 allows local users to gain privileges or cau

CVE-2016-0728 HIGH POC
7.8 Feb 08

The join_session_keyring function in security/keys/process_keys.c in the Linux kernel before 4.4.1 mishandles object ref

CVE-2017-0561 CRITICAL POC
9.8 Apr 07

A remote code execution vulnerability in the Broadcom Wi-Fi firmware could enable a remote attacker to execute arbitrary

CVE-2022-2588 MEDIUM POC
5.3 Jan 08

It was discovered that the cls_route filter implementation in the Linux kernel would not remove an old filter from the h

Vendor StatusVendor

Debian

linux
Release Status Fixed Version Urgency
bullseye fixed 5.10.223-1 -
bullseye (security) fixed 5.10.251-1 -
bookworm fixed 6.1.159-1 -
bookworm (security) fixed 6.1.164-1 -
trixie fixed 6.12.73-1 -
trixie (security) fixed 6.12.74-2 -
forky fixed 6.19.6-2 -
sid fixed 6.19.8-1 -
(unstable) not-affected - -

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

EUVD-2025-20916 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy