CVE-2025-38340

What it actually does

Out-of-bounds memory read in cs_dsp_mock_bin_add_name_or_info() caused by source string length being rounded up to allocation size, allowing KASAN-detected access past buffer bounds in KUnit test code.

Why it matters to the business

Potential kernel test instability or crashes during development and validation of firmware DSP components on affected Linux LTS builds; negligible production risk as the flaw is confined to test mocking logic with no known active exploitation.

How an attack unfolds

An attacker would need to compile and execute the vulnerable KUnit test suite on a kernel build that includes the cs_dsp mock functions, triggering the length miscalculation to read beyond allocated memory; no evidence of real-world use by threat actors.

How to fix it

Update to fixed kernel versions: linux-lts (Alpaquita:23) 6.1.81-r0 or newer, linux-lts (Alpaquita:stream) 6.6.58-r0 or 6.12.41-r0 or newer, and GIT commit 8f4cc454a0bb45b800bc7817c09c8f72e31901f3 or equivalent stable backports.

How to confirm the fix worked

Confirm running kernel version matches or exceeds the listed fixed releases; re-execute cs_dsp KUnit tests under KASAN and verify absence of out-of-bounds reports for the mock name/info function.

Typical attack path

1. Build or boot a vulnerable Linux kernel with KUnit and cs_dsp test support enabled
2. Invoke the cs_dsp KUnit test that calls cs_dsp_mock_bin_add_name_or_info()
3. Trigger string allocation path where length rounding exceeds buffer
4. Observe or exploit resulting out-of-bounds read via KASAN or memory inspection

How to detect it

Search kernel logs and KASAN output for mentions of cs_dsp_mock_bin_add_name_or_info and out-of-bounds read; review test execution artifacts from development builds for signs of the allocation length mismatch.

What your security team should do

• Prioritize kernel package upgrades on all development and test systems using the listed Alpaquita linux-lts variants
• Include the specific fixed versions in patch management automation
• Re-run affected KUnit suites post-update to validate resolution
• Monitor EPSS and KEV updates given the low but non-zero exploitation probability