Out-of-Bounds Memory Access in Linux Kernel - CVE-2025-38330
Summary
CVE-2025-38330: In the Linux kernel, the following vulnerability has been resolved: firmware: cs_dsp: Fix OOB memory read access in KUnit test (ctl cache) KASAN reported out of bounds access - cs_dsp_ctl_cache_init_multiple_offsets(). Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, responsible for managing hardware resources and providing essential services to software applications. It is known for its stability, performance, and flexibility, making it a popular choice for servers, desktops, and embedded systems. However, like any complex software, it is susceptible to vulnerabilities that can compromise system integrity and security.
Vulnerability Detail
CVE-2025-38330 is a vulnerability in the Linux kernel related to an out-of-bounds (OOB) memory read access in the cs_dsp firmware. This issue arises from a mismatch in the expected length of register value allocations. Initially, the code allocates 4 bytes for the mock_coeff_template.length_bytes, but later it is incorrectly set to 8 bytes, leading to potential test code failures and exposing the system to instability or crashes. The Kernel Address Sanitizer (KASAN) reported this issue, highlighting the need for immediate attention to prevent exploitation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating the Linux kernel package as described above.
Conclusion
CVE-2025-38330 represents a significant vulnerability in the Linux kernel that requires immediate attention. Users are advised to update their systems to the latest patched version to mitigate the risks associated with this out-of-bounds memory access issue. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38330 is a vulnerability in the Linux kernel that involves an out-of-bounds memory access in the cs_dsp firmware, which can lead to system instability.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
The risks include system crashes, instability, and potential exploitation by malicious actors if the vulnerability is not addressed.
Yes, a patch is available. Users should update their Linux kernel package to the latest version to mitigate the vulnerability.
While there are no specific workarounds, it is crucial to prioritize updating your system as soon as possible to ensure security.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
