CVE-2025-38299: ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY()
In the Linux kernel, the following vulnerability has been resolved:
ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMPDUMMY()
ETDM2INBE and ETDM1OUTBE are defined as COMPEMPTY(), in the case the codec dainame will be null.
Avoid a crash if the device tree is not assigning a codec to these links.
[ 1.179936] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 1.181065] Mem abort info: [ 1.181420] ESR = 0x0000000096000004 [ 1.181892] EC = 0x25: DABT (current EL), IL = 32 bits [ 1.182576] SET = 0, FnV = 0 [ 1.182964] EA = 0, S1PTW = 0 [ 1.183367] FSC = 0x04: level 0 translation fault [ 1.183983] Data abort info: [ 1.184406] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 [ 1.185097] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 1.185766] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 1.186439] [0000000000000000] user address but activemm is swapper [ 1.187239] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP [ 1.188029] Modules linked in: [ 1.188420] CPU: 7 UID: 0 PID: 70 Comm: kworker/u32:1 Not tainted 6.14.0-rc4-next-20250226+ #85 [ 1.189515] Hardware name: Radxa NIO 12L (DT) [ 1.190065] Workqueue: eventsunbound deferredprobeworkfunc [ 1.190808] pstate: 40400009 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 1.191683] pc : pistrcmp+0x24/0x140 [ 1.192170] lr : mt8195mt6359soccardprobe+0x224/0x7b0 [ 1.192854] sp : ffff800083473970 [ 1.193271] x29: ffff800083473a10 x28: 0000000000001008 x27: 0000000000000002 [ 1.194168] x26: ffff800082408960 x25: ffff800082417db0 x24: ffff800082417d88 [ 1.195065] x23: 000000000000001e x22: ffff800082dbf480 x21: ffff800082dc07b8 [ 1.195961] x20: 0000000000000000 x19: 0000000000000013 x18: 00000000ffffffff [ 1.196858] x17: 000000040044ffff x16: 005000f2b5503510 x15: 0000000000000006 [ 1.197755] x14: ffff800082407af0 x13: 6e6f69737265766e x12: 692d6b636f6c6374 [ 1.198651] x11: 0000000000000002 x10: ffff80008240b920 x9 : 0000000000000018 [ 1.199547] x8 : 0101010101010101 x7 : 0000000000000000 x6 : 0000000000000000 [ 1.200443] x5 : 0000000000000000 x4 : 8080808080000000 x3 : 303933383978616d [ 1.201339] x2 : 0000000000000000 x1 : ffff80008240b920 x0 : 0000000000000000 [ 1.202236] Call trace: [ 1.202545] pistrcmp+0x24/0x140 (P) [ 1.203029] mtksoundcardcommonprobe+0x3bc/0x5b8 [ 1.203644] platformprobe+0x70/0xe8 [ 1.204106] reallyprobe+0xc8/0x3a0 [ 1.204556] driverprobedevice+0x84/0x160 [ 1.205104] driverprobedevice+0x44/0x130 [ 1.205630] deviceattachdriver+0xc4/0x170 [ 1.206189] busforeachdrv+0x8c/0xf8 [ 1.206672] deviceattach+0xa8/0x1c8 [ 1.207155] deviceinitialprobe+0x1c/0x30 [ 1.207681] busprobedevice+0xb0/0xc0 [ 1.208165] deferredprobeworkfunc+0xa4/0x100 [ 1.208747] processonework+0x158/0x3e0 [ 1.209254] workerthread+0x2c4/0x3e8 [ 1.209727] kthread+0x134/0x1f0 [ 1.210136] retfromfork+0x10/0x20 [ 1.210589] Code: 54000401 b50002c6 d503201f f86a6803 (f8408402) [ 1.211355] ---[ end trace 0000000000000000 ]---
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In the mt8195 ASoC device tree / machine driver, set ETDM1/2 IN/OUT to COMP_DUMMY() so that if the codec is not assigned (codec dai_name is null), the ETDM2_IN_BE/ETDM1_OUT_BE paths use COMP_EMPTY() and avoid a NULL pointer dereference crash.
ASoC (mediatk mt8195) ETDM1/2 routing ETDM1/2 IN/OUT to codec component placeholders = COMP_DUMMY()
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38299?
CVE-2025-38299 has been classified as a moderate severity vulnerability affecting the Linux kernel.
How do I fix CVE-2025-38299?
To resolve CVE-2025-38299, update your Linux kernel to the latest stable version that addresses this issue.
What does CVE-2025-38299 impact?
CVE-2025-38299 affects the audio subsystem in the Linux kernel, specifically related to MediaTek devices.
Is CVE-2025-38299 exploitable?
While CVE-2025-38299 can potentially lead to a device crash, it is not considered trivially exploitable.
When was CVE-2025-38299 published?
CVE-2025-38299 was published as a vulnerability in the year 2025.