CVE-2025-37979

What it actually does

Out-of-bounds array access in sc7280_snd_hw_params() and related functions due to case values exceeding the defined LPASS_MAX_PORTS, enabling buffer overflow in the Linux kernel ASoC qcom driver.

Why it matters to the business

Affected Linux systems may experience kernel crashes, denial of service, or potential local privilege escalation, disrupting operations on servers and endpoints using the impacted Ubuntu packages and requiring urgent patching to maintain stability and security.

How an attack unfolds

An attacker with local access triggers the vulnerable audio path by supplying crafted parameters that hit undefined port IDs such as RX_CODEC_DMA_RX_0, causing the out-of-bounds read/write; the flaw was introduced in earlier Audioreach support commits and can be reached through userspace sound APIs.

How to fix it

Upgrade to the listed fixed package versions for each Ubuntu release (for example linux 3.11.0-12.19 on 14.04 LTS, 4.4.0-2.16 on 16.04 LTS, 4.13.0-16.19 on 18.04 LTS, and 5.4.0-9.12 on 20.04 LTS) and reboot.

How to confirm the fix worked

Verify the running kernel package version matches or exceeds the fixed version for the distribution, then confirm the updated source no longer defines LPASS_MAX_PORTS too narrowly for q6dsp port IDs.

Typical attack path

1. Obtain local user access on an affected Ubuntu system
2. Invoke ALSA or ASoC sound hardware parameter functions with high port ID values
3. Trigger the sc7280 driver code path that indexes beyond array bounds
4. Achieve memory corruption leading to crash or escalation

How to detect it

Review kernel ring buffer and syslog for oops traces mentioning sc7280_snd_hw_params or lpass port IDs; examine audit logs for unusual ALSA ioctl activity on affected kernels.

What your security team should do

• Prioritize patching all listed Ubuntu linux, linux-aws, linux-azure and related packages within the next maintenance window
• Monitor kernel logs for audio driver oops or panic messages after applying updates
• Restrict local user access to audio devices on high-value systems until patches are deployed