CVE-2025-38662

What it actually does

Incorrect size passed to mt8365_dai_set_priv causes asan_memcpy to copy beyond the bounds of the intended struct mtk_afe_i2s_priv, resulting in global-out-of-bounds access during ASoC I2S DAI registration.

Why it matters to the business

Kernel memory corruption in the audio driver on affected Mediatek platforms can lead to crashes or unpredictable behavior during device initialization; low exploitation likelihood limits widespread operational impact.

How an attack unfolds

An attacker with the ability to trigger loading or probing of the snd_soc_mt8365_pcm driver causes mt8365_dai_i2s_register to invoke mt8365_dai_set_priv with an oversized source buffer, performing the out-of-bounds memcpy reported by KASAN.

How to fix it

Update the Linux kernel to commit 1dc0ed16cfbc3c28a07a89904071cfa802fdcee1 or later; for Chainguard packages apply the listed fixed versions such as 0.53.0-r0.

How to confirm the fix worked

Confirm the presence of the corrected size argument in mt8365_dai_set_priv callers and verify absence of KASAN reports during driver probe after applying the fix.

Typical attack path

1. Load or modprobe the mt8365 ASoC PCM driver on a vulnerable kernel
2. Platform probe calls mt8365_afe_pcm_dev_probe
3. mt8365_dai_i2s_register invokes mt8365_dai_set_priv with afe_priv instead of the correct I2S priv struct
4. asan_memcpy performs out-of-bounds copy triggering KASAN report or memory corruption

How to detect it

Search kernel logs for KASAN global-out-of-bounds reports referencing mt8365_dai_set_priv or snd_soc_mt8365_pcm during platform_probe and driver registration.

What your security team should do

• Prioritize kernel updates on any Mediatek mt8365-based systems within normal patch cycles
• Monitor for KASAN or slab corruption reports during audio driver initialization
• Validate that downstream images incorporate the referenced commit before deployment