Buffer Overflow in MediaTek MT8365 I2S Driver by Linux Vendor

CVE-2025-38662

What is CVE-2025-38662?

A buffer overflow vulnerability exists in the MediaTek MT8365 I2S driver within the Linux kernel. This vulnerability arises when incorrect size parameters are passed to the 'mt8365_dai_set_priv' function, which is responsible for memory allocation. The function allocates memory for 'priv_data' but uses an incorrect structure size, potentially leading to out-of-bounds memory access. This situation triggers a Kernel Address Sanitizer (KASAN) alert, indicating a serious flaw that could be exploited. It is crucial for users of the affected driver to apply the recommended patches to mitigate the risks associated with this vulnerability.

References