Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseCVE-2025-37979
CVE-2025-37979:
Linux Kernel vulnerability analysis and mitigation
Overview
A buffer overflow vulnerability was discovered in the Linux kernel's ASoC (ALSA System on Chip) Qualcomm driver for sc7280 LPASS (Low Power Audio SubSystem). The vulnerability was identified on May 20, 2025, and affects the case values introduced in commit 5f78e1fb7a3e which handles audioreach solution support (NVD).
Technical details
The vulnerability stems from out-of-bounds access in arrays of sc7280 driver data, specifically occurring in the sc7280sndhwparams() function when handling cases like RXCODECDMARX_0. The issue was discovered by the Linux Verification Center using the SVACE tool (NVD).
Impact
The vulnerability could lead to buffer overflow conditions in the Linux kernel's audio subsystem, potentially affecting system stability and security when processing audio on affected Qualcomm platforms (NVD).
Mitigation and workarounds
The fix involves redefining LPASSMAXPORTS to properly consider the maximum possible port ID for q6dsp, as the sc7280 driver utilizes some of these values (NVD).
Additional resources
Source: This report was generated using AI
Related Linux Kernel vulnerabilities:
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management