CVE-2025-38329

What it actually does

Out-of-bounds memory read in cs_dsp_mock_wmfw_add_info() KUnit test function due to source string length being rounded up to allocation size, reported by KASAN.

Why it matters to the business

Limited to kernel development and testing environments with no production impact; low operational risk given low exploit probability and absence from known exploitation lists.

How an attack unfolds

An attacker with ability to execute or influence KUnit tests in the cs_dsp driver could trigger the mock wmfw info addition path, causing an out-of-bounds read on a rounded-up string buffer in test memory.

How to fix it

Update linux-lts packages to fixed versions: Alpaquita 23 to 6.1.81-r0, Alpaquita stream to 6.6.58-r0 or 6.12.41-r0; apply git commit 0000a2303ba78b6424ff15b5085b5f5098750a2e in custom kernel builds.

How to confirm the fix worked

Verify installed kernel version matches or exceeds listed fixed versions; re-run affected KUnit tests under KASAN to confirm absence of out-of-bounds reports in cs_dsp_mock_wmfw_add_info.

Typical attack path

1. Gain access to a system running vulnerable kernel with KUnit tests enabled
2. Trigger or modify execution of cs_dsp KUnit tests involving wmfw info handling
3. Observe or leverage resulting KASAN-detected out-of-bounds memory read

How to detect it

Search kernel logs and CI test output for KASAN reports referencing cs_dsp_mock_wmfw_add_info or wmfw info OOB access; no production runtime indicators exist.

What your security team should do

• Prioritize kernel package updates on development and CI systems running KUnit tests
• Disable or isolate KUnit test execution from production kernels
• Monitor EPSS trend and re-evaluate if exploit maturity increases