Critical Vulnerability in Linux Kernel: Null-Terminated Array Issue in cs42l43 Driver
Summary
DEBIAN-CVE-2025-38573: In the Linux kernel, the following vulnerability has been resolved: spi: cs42l43: Property entry should be a null-terminated array The software node does not specify a count of property entries, so the array must be null... Affects linux versions < 6.12.43-1. Fixed in 6.12.43-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It is known for its stability, performance, and versatility, supporting a wide range of hardware architectures. However, it is also susceptible to vulnerabilities that can impact system security and functionality. This specific vulnerability affects the cs42l43 driver, which is responsible for audio processing in certain hardware configurations.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the spi: cs42l43 driver related to property entries not being null-terminated. This oversight can lead to a fault in the downstream cs35l56 amplifier driver, as the node parse may access memory beyond the intended array bounds, potentially causing system crashes or unpredictable behavior. The issue arises from the software node's failure to specify a count of property entries, making it critical for developers to address this flaw promptly.
How To Fix
Minimum fixed version
6.12.43-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds are provided for this vulnerability. It is recommended to apply the patch as soon as it becomes available to mitigate any potential risks associated with this issue.
Conclusion
The vulnerability in the Linux kernel related to the cs42l43 driver poses significant risks due to memory access issues. Users are strongly advised to update to the patched versions to ensure system stability and security. Monitoring tools like Vulert can assist in identifying vulnerabilities in your software without requiring code access.
See every vulnerability recorded for linux →
FAQ
The vulnerability is related to the cs42l43 driver in the Linux kernel, where property entries are not null-terminated, leading to potential memory access issues.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
The risks include system crashes and unpredictable behavior due to memory access violations caused by the unterminated array.
Yes, patched versions of the Linux kernel are available: 6.12.43-1 for Debian 13 and 6.16.3-1 for Debian 14.
While no specific workarounds are available, it is crucial to prioritize updating your kernel to mitigate the risks associated with this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
