Soundwire Vulnerability in Dragonboard 845c by Qualcomm

CVE-2025-38486

What is CVE-2025-38486?

A vulnerability in the Soundwire subsystem of the Linux kernel has been identified, specifically affecting the Dragonboard 845c platform. The root cause stems from a reverted patch that introduced inconsistencies in memory handling and array indexing. Notably, the faulty code manipulates the ctrl->pconfig[] structure incorrectly, leading to memory corruption and potential kernel panic, characterized by an unexpected kernel BRK exception at EL1. Additionally, the issues reported highlight a misalignment in the expected number of elements within the tx_ch[] array versus the allocated memory in the ctrl->pconfig[] array. This vulnerability not only compromises the stability of the Dragonboard 845c but also raises concerns about the reliability of future patches and updates within the Soundwire framework.

References