CVE-2025-38573

What it actually does

Out-of-bounds memory access during software node property parsing in the cs42l43 SPI driver when the property array lacks null termination, allowing the downstream cs35l56 amplifier driver to read past the array into unknown memory.

Why it matters to the business

System instability, crashes, or faults during audio device initialization on affected Linux kernels, potentially disrupting operations on systems using cs42l43 hardware and requiring emergency patching across fleets.

How an attack unfolds

An attacker with the ability to influence SPI device node properties (via crafted device tree, ACPI, or module parameters) supplies an unterminated property array; during driver probe the parse routine walks off the end, triggering a fault in the cs35l56 driver that can lead to kernel panic or memory corruption.

How to fix it

Update to fixed kernel commit 674328102baad76c7a06628efc01974ece5ae27f or later; for Chainguard packages upgrade openjdk-11-openj9 and related variants to 0.53.0-r0 or newer.

How to confirm the fix worked

Verify kernel source contains the null-termination fix or confirm installed package versions match the listed fixed releases; test cs42l43 device probe under load to ensure no out-of-bounds access occurs.

Typical attack path

1. Gain local access or control over device tree / firmware configuration
2. Provide malformed property array for cs42l43 node lacking null terminator
3. Trigger driver load or device probe (boot, module insertion, or hotplug)
4. Kernel property parser walks past array end into adjacent memory
5. cs35l56 driver dereferences invalid data causing fault or corruption

How to detect it

Review kernel logs for oops or panic messages referencing cs42l43, cs35l56, or property parsing; inspect dmesg and journalctl around device probe events for memory fault indicators.

What your security team should do

• Prioritize kernel and affected package updates on all systems exposing cs42l43 SPI devices
• Audit device trees and firmware for proper null-terminated property arrays
• Monitor for post-update stability in audio amplifier initialization paths
• Apply updates before the next maintenance window given the memory corruption class