Out-of-Bounds Memory Access in Linux Kernel - CVE-2025-38340
Summary
CVE-2025-38340: In the Linux kernel, the following vulnerability has been resolved: firmware: cs_dsp: Fix OOB memory read access in KUnit test KASAN reported out of bounds access - cs_dsp_mock_bin_add_name_or_info(), because the source... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interactions. It is known for its stability, performance, and security features. However, like any complex software, it can have vulnerabilities. CVE-2025-38340 affects the Linux kernel versions in Debian 11, 12, and 13, specifically related to the firmware handling in the cs_dsp module.
Vulnerability Detail
CVE-2025-38340 is a vulnerability in the Linux kernel that allows for an out-of-bounds (OOB) memory read access. This issue arises in the KUnit test for the cs_dsp firmware, where the source string length is incorrectly rounded up to the allocation size. This can lead to potential information leaks or crashes, as the kernel may access memory locations that it should not, compromising system stability and security.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, no specific workaround is provided for this vulnerability. The best course of action is to apply the patch as soon as it becomes available.
Conclusion
CVE-2025-38340 represents a significant security concern for users of the Linux kernel in Debian systems. It is essential to stay informed about updates and apply patches promptly to maintain system integrity and security.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38340 is a vulnerability in the Linux kernel that involves an out-of-bounds memory read access in the cs_dsp firmware module.
The vulnerability affects Debian versions 11, 12, and 13 that utilize the Linux kernel.
You can use tools like Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Yes, a patch is expected to be released in the upcoming updates for the Linux kernel in Debian. Users should regularly check for updates.
While no specific workaround is available, it is crucial to plan for an update as soon as possible to mitigate the risk associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
