Buffer Overflow Vulnerability in Linux Kernel - ASoC: qcom Driver
Summary
CVE-2025-37979: In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: Fix sc7280 lpass potential buffer overflow Case values introduced in commit 5f78e1fb7a3e ("ASoC: qcom: Add driver support for audioreach sol... Affects linux versions < 6.1.137-1. Fixed in 6.1.137-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of various operating systems, providing essential services for hardware and software interaction. It supports a wide range of functionalities, including device drivers, file systems, and network protocols. The ASoC (ALSA System on Chip) framework is part of the Linux kernel that facilitates audio processing on SoC devices. The vulnerability in question affects the qcom (Qualcomm) driver, specifically the sc7280 variant, which is responsible for audio processing in certain Qualcomm chipsets.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the ASoC: qcom driver related to the sc7280 chipset. This issue arises from case values introduced in commit 5f78e1fb7a3e, which can lead to out-of-bounds access in arrays of the sc7280 driver data. Specifically, when handling RX_CODEC_DMA_RX_0 in the sc7280_snd_hw_params() function, this can result in a potential buffer overflow. Such vulnerabilities can lead to system crashes, data corruption, or unauthorized access to sensitive information.
How To Fix
Minimum fixed version
6.1.137-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating to the fixed versions of the Linux kernel.
Conclusion
The CVE-2025-37979 vulnerability in the Linux kernel's ASoC: qcom driver poses significant risks due to potential buffer overflow issues. Users are strongly encouraged to update their systems to the patched versions to safeguard against these vulnerabilities.
See every vulnerability recorded for linux →
FAQ
CVE-2025-37979 is a vulnerability in the Linux kernel's ASoC: qcom driver that can lead to a buffer overflow due to out-of-bounds access in the sc7280 driver data.
This vulnerability can potentially lead to system crashes, data corruption, or unauthorized access to sensitive information, making it critical to address.
If you are using a version of the Linux kernel prior to the patched versions (6.1.137-1 for Debian 12 and 6.12.25-1 for Debian 13), your system may be vulnerable.
While there are no specific workarounds, it is advisable to monitor your system closely and apply the update as soon as possible to mitigate risks.
You can find more details about CVE-2025-37979 in the official CVE database or by visiting the Linux Verification Center's website.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
