CVE-2024-42088

What it actually does

Missing COMP_EMPTY() platform entry for ETDM1_OUT_BE DAI link leaves platforms array unallocated, triggering out-of-bounds access in mtk_soundcard_common_probe() when iterating card prelinks and assigning platform_node.

Why it matters to the business

Kernel instability or crashes on MediaTek MT8195-based audio devices can interrupt audio services, require reboots, and affect embedded or consumer Linux systems using the driver.

How an attack unfolds

An attacker triggers audio subsystem initialization (module load or boot) on a vulnerable kernel; the probe loop encounters a DAI link with no platforms entry, performing an invalid memory access that KASAN flags as out-of-bounds.

How to fix it

Update the Linux kernel to include commit 42b9ab7a4d7e6c5efd71847541e4fcc213585aad which adds the required COMP_EMPTY() platform entry for ETDM1_OUT_BE.

How to confirm the fix worked

Confirm the ETDM1_OUT_BE dai_link definition contains a platforms COMP_EMPTY() entry; boot a test system and verify absence of KASAN warnings in mtk_soundcard_common_probe().

Typical attack path

1. Load or initialize the mt8195 ASoC driver
2. mtk_soundcard_common_probe() iterates dai links
3. Accesses unallocated dai_link->platforms array
4. Triggers KASAN out-of-bounds warning or memory corruption

How to detect it

Search kernel logs for KASAN out-of-bounds warnings referencing mtk_soundcard_common_probe() or mt8195 sound card probe paths.

• KASAN: out-of-bounds in mtk_soundcard_common_probe
• sound/soc/mediatek/common/mtk-soundcard-driver.c
• dai_link->platforms->of_node assignment without platforms entry

What your security team should do

• Apply the referenced commit or newer stable kernel containing the fix
• Monitor kernel logs for KASAN warnings during audio driver initialization
• Test audio functionality on MT8195 hardware after patching