CVE-2025-39935 (GCVE-0-2025-39935)

Vulnerability from cvelistv5 – Published: 2025-10-04 07:30 – Updated: 2026-08-05 12:06
VLAI
Title
ASoC: codec: sma1307: Fix memory corruption in sma1307_setting_loaded()
Summary
In the Linux kernel, the following vulnerability has been resolved: ASoC: codec: sma1307: Fix memory corruption in sma1307_setting_loaded() The sma1307->set.header_size is how many integers are in the header (there are 8 of them) but instead of allocating space of 8 integers we allocate 8 bytes. This leads to memory corruption when we copy data it on the next line: memcpy(sma1307->set.header, data, sma1307->set.header_size * sizeof(int)); Also since we're immediately copying over the memory in ->set.header, there is no need to zero it in the allocator. Use devm_kmalloc_array() to allocate the memory instead.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 576c57e6b4c1d734bcb7cc33dde9a99a9383b520 , < cd59ca8f75dbb42a67fcae975c766114644e36c4 (git)
Affected: 576c57e6b4c1d734bcb7cc33dde9a99a9383b520 , < 78338108b5a856dc98223a335f147846a8a18c51 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.13
Unaffected: 0 , < 6.13 (semver)
Unaffected: 6.16.9 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/soc/codecs/sma1307.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cd59ca8f75dbb42a67fcae975c766114644e36c4",
              "status": "affected",
              "version": "576c57e6b4c1d734bcb7cc33dde9a99a9383b520",
              "versionType": "git"
            },
            {
              "lessThan": "78338108b5a856dc98223a335f147846a8a18c51",
              "status": "affected",
              "version": "576c57e6b4c1d734bcb7cc33dde9a99a9383b520",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/soc/codecs/sma1307.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.9",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: codec: sma1307: Fix memory corruption in sma1307_setting_loaded()\n\nThe sma1307-\u003eset.header_size is how many integers are in the header\n(there are 8 of them) but instead of allocating space of 8 integers\nwe allocate 8 bytes.  This leads to memory corruption when we copy data\nit on the next line:\n\n        memcpy(sma1307-\u003eset.header, data,\n               sma1307-\u003eset.header_size * sizeof(int));\n\nAlso since we\u0027re immediately copying over the memory in -\u003eset.header,\nthere is no need to zero it in the allocator.  Use devm_kmalloc_array()\nto allocate the memory instead."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached through a local ALSA mixer control write (`SNDRV_CTL_IOCTL_ELEM_WRITE` on `/dev/snd/controlC*` \u2192 `sma1307_reset_put()` \u2192 `sma1307_reset()` \u2192 `sma1307_setting_loaded()`), or at driver probe on an I2C-attached codec. There is no network or adjacent-network reachability.\nAC:L - The mismatch is unconditional \u2014 `devm_kzalloc(dev, 8)` followed by a 32-byte `memcpy` overflows on every single settings load, with no race, no timing window, and no memory-layout precondition. The attacker can re-trigger it arbitrarily many times via the \"Reset Switch\" control, and the accompanying devres leak provides repeatable heap grooming.\nPR:L - Triggering requires only write access to the sound control device (`root:audio 0660`, plus logind ACL for the active session user; the audio server on Android) \u2014 an ordinary unprivileged local account, with no capability check anywhere along `snd_ctl_elem_write()` \u2192 `sma1307_reset_put()`.\nUI:N - The attacker writes the mixer control directly from their own process; no victim action, no file open, and no administrator step is needed. The probe-time path also fires automatically at boot.\nS:U - The out-of-bounds write corrupts kernel slab memory within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The `memcpy` reads 32 bytes from a `kzalloc(fw-\u003esize)` buffer that may be as small as 8 bytes, disclosing up to 24 bytes of adjacent kernel heap into `set.header` (readable back through the driver\u0027s binary/register paths). More broadly, an adjacent-slab-object overwrite of SLUB freelist metadata is a well-established route to an arbitrary kernel read primitive.\nI:H - This is a 24-byte heap buffer overflow that writes past the `kmalloc-64` devres object into the neighbouring slab allocation, corrupting whatever kernel object or SLUB freelist pointer sits there. Combined with the repeatable-allocation grooming primitive, this is exploitable for controlled memory corruption and privilege escalation, especially where the firmware file content is attacker-influenceable.\nA:H - Slab corruption of an adjacent object reliably produces oopses/panics (immediate KASAN slab-out-of-bounds report on instrumented kernels), and each \"Reset Switch\" write additionally leaks devres allocations for `header`, `def`, and all `mode_set[]` entries without freeing the previous ones, allowing an unprivileged user to exhaust kernel memory."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:06:13.802Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cd59ca8f75dbb42a67fcae975c766114644e36c4"
        },
        {
          "url": "https://git.kernel.org/stable/c/78338108b5a856dc98223a335f147846a8a18c51"
        }
      ],
      "title": "ASoC: codec: sma1307: Fix memory corruption in sma1307_setting_loaded()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39935",
    "datePublished": "2025-10-04T07:30:59.102Z",
    "dateReserved": "2025-04-16T07:20:57.148Z",
    "dateUpdated": "2026-08-05T12:06:13.802Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-39935",
      "date": "2026-10-01",
      "epss": "0.00143",
      "percentile": "0.02989"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "sound/soc/codecs/sma1307.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "cd59ca8f75dbb42a67fcae975c766114644e36c4",
                    "status": "affected",
                    "version": "576c57e6b4c1d734bcb7cc33dde9a99a9383b520",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "78338108b5a856dc98223a335f147846a8a18c51",
                    "status": "affected",
                    "version": "576c57e6b4c1d734bcb7cc33dde9a99a9383b520",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "sound/soc/codecs/sma1307.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.13"
                  },
                  {
                    "lessThan": "6.13",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.16.*",
                    "status": "unaffected",
                    "version": "6.16.9",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.17",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "638DD910-1189-4F5E-98BF-2D436B695112",
                    "versionEndExcluding": "6.16.9",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "327D22EF-390B-454C-BD31-2ED23C998A1C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "C730CD9A-D969-4A8E-9522-162AAF7C0EE9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "39982C4B-716E-4B2F-8196-FA301F47807D",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "340BEEA9-D70D-4290-B502-FBB1032353B1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "47E4C5C0-079F-4838-971B-8C503D48FCC2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc6:*:*:*:*:*:*",
                    "matchCriteriaId": "5A4516A6-C12E-42A4-8C0E-68AEF3264504",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: codec: sma1307: Fix memory corruption in sma1307_setting_loaded()\n\nThe sma1307-\u003eset.header_size is how many integers are in the header\n(there are 8 of them) but instead of allocating space of 8 integers\nwe allocate 8 bytes.  This leads to memory corruption when we copy data\nit on the next line:\n\n        memcpy(sma1307-\u003eset.header, data,\n               sma1307-\u003eset.header_size * sizeof(int));\n\nAlso since we\u0027re immediately copying over the memory in -\u003eset.header,\nthere is no need to zero it in the allocator.  Use devm_kmalloc_array()\nto allocate the memory instead."
          }
        ],
        "id": "CVE-2025-39935",
        "lastModified": "2026-07-30T06:23:58.840",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-10-04T08:15:46.333",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/78338108b5a856dc98223a335f147846a8a18c51"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/cd59ca8f75dbb42a67fcae975c766114644e36c4"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-787"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:24:35+00:00",
      "cve": "CVE-2025-39935",
      "id": "CVE-2025-39935",
      "initial_release_date": "2025-10-04T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ASoC: codec: sma1307: Fix memory corruption in sma1307_setting_loaded()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-39935.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-01T13:44:36Z",
      "cve": "CVE-2025-39935",
      "id": "CVE-2025-39935",
      "initial_release_date": "2025-10-06T23:27:16Z",
      "product_status:known_affected": "67",
      "product_status:known_not_affected": "456",
      "product_status:recommended": "27",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-39935",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-39935.json",
      "version": "10"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.