Memory Corruption Vulnerability in Linux Kernel's AD4851 and AD4858 Components

CVE-2025-38133

What is CVE-2025-38133?

A vulnerability in the Linux kernel affecting the AD4851 and AD4858 components has been identified, which arises from improper pointer handling during channel parsing. The issue occurs when an internal pointer is incremented each time a channel is populated without maintaining the reference to the base pointer. This can lead to the indio_dev->channels being assigned a pointer beyond the allocated array limit, posing risks of memory corruption and undefined behavior. The fix involves utilizing explicit indexing while iterating through channels to ensure correct setting of all channel metadata and to prevent accessing invalid memory locations.

References