CVE-2025-38330

What it actually does

Out-of-bounds memory read in KUnit test code for cs_dsp_ctl_cache_init_multiple_offsets() caused by inconsistent length_bytes value (4 bytes allocated, 8 bytes used) leading to KASAN-detected access beyond buffer bounds.

Why it matters to the business

Test failures and potential false positives during kernel development or CI pipelines on affected Linux distributions; no production runtime impact but delays validation of downstream kernel builds used by many systems.

How an attack unfolds

An attacker with access to run KUnit tests on a vulnerable kernel build can trigger the test function, causing the length override to exceed the allocated buffer and read adjacent memory during mock coefficient cache initialization.

How to fix it

Update to fixed kernel versions: linux-lts (Alpaquita:stream) 6.6.58-r0 or 6.12.41-r0, linux-lts (Alpaquita:23) 6.1.89-r0, or mainline commit e3dafc64b90546eb769f33333afabd9e3e915757. Rebuild and re-run KUnit tests after upgrade.

How to confirm the fix worked

Rebuild kernel with KUnit enabled, execute cs_dsp_ctl_cache tests under KASAN, and confirm absence of out-of-bounds reports and that length_bytes remains consistently 4 bytes throughout the test.

Typical attack path

1. Compile and boot a kernel containing the affected cs_dsp KUnit test
2. Execute the ctl cache initialization test with mock_coeff_template
3. Trigger length_bytes override from 4 to 8 bytes
4. Perform out-of-bounds read during register value allocation

How to detect it

Review kernel build logs and KUnit test output for KASAN reports mentioning cs_dsp_ctl_cache_init_multiple_offsets or mock_coeff_template length mismatch; no runtime indicators exist in production kernels.

What your security team should do

• Prioritize kernel package updates on all build and test systems within standard maintenance windows
• Add KASAN-enabled KUnit runs to CI pipelines to catch similar test regressions early
• Monitor EPSS trend and re-evaluate if exploit maturity increases