Listen to this Post
How the mentioned CVE works:
This vulnerability exists in the MediaTek MT8195 sound card driver of the Linux kernel. The backend digital audio interfaces (DAIs) named ETDM2_IN_BE and ETDM1_OUT_BE were incorrectly initialized as COMP_EMPTY(). This results in their associated codec `dai_name` being a null pointer. If the device tree does not assign a codec to these specific audio links, a kernel oops (crash) occurs when the driver attempts to use a string comparison function (__pi_strcmp) with this null pointer, leading to a NULL pointer dereference. This is a classic use-after-free/crash condition triggered during probe of the sound card.
DailyCVE Form:
Platform: Linux Kernel
Version: MediaTek MT8195 ASoC
Vulnerability: NULL Pointer Dereference
Severity: Medium
Date: 2025-07-10
Prediction: Patch expected by 2025-08-01
What Undercode Say:
grep -r "ETDM._BE" drivers/soc/mediatek/ cat /sys/kernel/debug/device_component/ dmesg | grep "Unable to handle kernel NULL pointer"
// Vulnerable Code (before patch): SND_SOC_DAILINK_DEFS(ETDM2_IN_BE, DAILINK_COMP_ARRAY(COMP_EMPTY())); // dai_name becomes NULL // Patched Code: SND_SOC_DAILINK_DEFS(ETDM2_IN_BE, DAILINK_COMP_ARRAY(COMP_DUMMY())); // Uses a dummy component
How Exploit:
Trigger deferred probe for sound card. Malicious Device Tree blob. Cause kernel panic on boot.
Protection from this CVE:
Update kernel. Apply vendor patch. Use `COMP_DUMMY()` for unused links.
Impact:
Kernel panic. Denial-of-Service. System crash during boot.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
