SECUFOCUSNOW
Home›CVE index›CVE-2025-39935
Review reviewHigh

CVE-2025-39935

Linux Linux, linux kernel

In the Linux kernel, the following vulnerability has been resolved: ASoC: codec: sma1307: Fix memory corruption in sma1307_setting_loaded() The sma1307->set.header_size is how many integers are in the header (there are 8 of them) but instead of allocating space of 8 integers we allocate 8 bytes. This leads to memory corruption when we copy data it on the next line: memcpy(sma1307->set.header, data, sma1307->set.header_size * sizeof(int)); Also since we're immediately copying over the memory in ->set.header, there is no need to zero it in the allocator. Use devm_kmalloc_array() to allocate t...

CVSS
7.8
EPSS
0.13%
3.26% percentile
CISA KEV
Not listed
Published
2025.10.04
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.13%
Technical severityCVSS 7.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: ASoC: codec: sma1307: Fix memory corruption in sma1307_setting_loaded() The sma1307->set.header_size is how many integers are in the header (there are 8 of them) but instead of allocating space of 8 integers we allocate 8 bytes. This leads to memory corruption when we copy data it on the next line: memcpy(sma1307->set.header, data, sma1307->set.header_size * sizeof(int)); Also since we're immediately copying over the memory in ->set.header, there is no need to zero it in the allocator. Use devm_kmalloc_array() to allocate t...

Affected product and versions

Product
Linux Linux, linux kernel
Affected versions
>= 576c57e6b4c1d734bcb7cc33dde9a99a9383b520 < cd59ca8f75dbb42a67fcae975c766114644e36c4, >= 576c57e6b4c1d734bcb7cc33dde9a99a9383b520 < 78338108b5a856dc98223a335f147846a8a18c51, >= 6.13, >= 6.13 < 6.16.9, 6.17
Fixed versions
6.16.9

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux Linux, linux kernel and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-787
CVE-2025-39935 — Linux Linux, linux kernel | SECUFOCUS NOW