CVE-2025-39935
Severity CVSS v4.0:
Pending analysis
Type:
CWE-787
Out-of-bounds Write
Publication date:
04/10/2025
Last modified:
27/01/2026
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
ASoC: codec: sma1307: Fix memory corruption in sma1307_setting_loaded()<br />
<br />
The sma1307->set.header_size is how many integers are in the header<br />
(there are 8 of them) but instead of allocating space of 8 integers<br />
we allocate 8 bytes. This leads to memory corruption when we copy data<br />
it on the next line:<br />
<br />
memcpy(sma1307->set.header, data,<br />
sma1307->set.header_size * sizeof(int));<br />
<br />
Also since we&#39;re immediately copying over the memory in ->set.header,<br />
there is no need to zero it in the allocator. Use devm_kmalloc_array()<br />
to allocate the memory instead.
Impact
Base Score 3.x
7.80
Severity 3.x
HIGH
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.13 (including) | 6.16.9 (excluding) |
| cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.17:rc4:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.17:rc5:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.17:rc6:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page