Memory Corruption in SMA1307 Codec in Linux Kernel

CVE-2025-39935

What is CVE-2025-39935?

A memory corruption vulnerability exists in the SMA1307 codec within the Linux kernel, stemming from improper memory allocation. Specifically, while the size of the header comprising eight integers necessitates a memory allocation for eight integers, an incorrect allocation of only eight bytes leads to corruption during data copy operations. This flaw can be exploited when the memory in the 'set.header' buffer is filled without prior proper allocation, creating potential instability and security risks in affected systems. It is recommended to utilize 'devm_kmalloc_array()' to ensure correct memory allocation, thus mitigating the issue effectively.

References