CVE: CVE-2025-38299
Published: 2025-07-10
Description: In the Linux kernel, the following vulnerability has been resolved:

ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY()

ETDM2_IN_BE and ETDM1_OUT_BE are defined as COMP_EMPTY(),
in the case the codec dai_name will be null.

Avoid a crash if the device tree is not assigning a codec
to these links.

[    1.179936] Unable to handle kernel NULL pointer dereference at virtual address [PII_REDACTED]
[    1.181065] Mem abort info:
[    1.181420]   ESR = 0x[PII_REDACTED]000004
[    1.181892]   EC = 0x25: DABT (current EL), IL = 32 bits
[    1.182576]   SET = 0, FnV = 0
[    1.182964]   EA = 0, S1PTW = 0
[    1.183367]   FSC = 0x04: level 0 translation fault
[    1.183983] Data abort info:
[    1.184406]   ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
[    1.185097]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0
[    1.185766]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[    1.186439] [[PII_REDACTED]] user address but active_mm is swapper
[    1.187239] Internal error: Oops: [PII_REDACTED] [#1] PREEMPT SMP
[    1.188029] Modules linked in:
[    1.188420] CPU: 7 UID: 0 PID: 70 Comm: kworker/u32:1 Not tainted 6.14.0-rc4-next-20250226+ #85
[    1.189515] Hardware name: Radxa NIO 12L (DT)
[    1.190065] Workqueue: events_unbound deferred_probe_work_func
[    1.190808] pstate: 40400009 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[    1.191683] pc : __pi_strcmp+0x24/0x140
[    1.192170] lr : mt8195_mt6359_soc_card_probe+0x224/0x7b0
[    1.192854] sp : ffff[PII_REDACTED]70
[    1.193271] x29: ffff800083473a10 x28: [PII_REDACTED] x27: [PII_REDACTED]
[    1.194168] x26: ffff[PII_REDACTED]60 x25: ffff800082417db0 x24: ffff800082417d88
[    1.195065] x23:[PII_REDACTED]00001e x22: ffff800082dbf480 x21: ffff800082dc07b8
[    1.195961] x20: [PII_REDACTED] x19: [PII_REDACTED] x18: 00000000ffffffff
[    1.196858] x17:[PII_REDACTED]44ffff x16: 005000f2b5503510 x15: [PII_REDACTED]
[    1.197755] x14: ffff800082407af0 x13: 6e6f[PII_REDACTED]6e x12: 692d6b636f6c6374
[    1.198651] x11: [PII_REDACTED] x10: ffff80008240b920 x9 : [PII_REDACTED]
[    1.199547] x8 : [PII_REDACTED] x7 : [PII_REDACTED] x6 : [PII_REDACTED]
[    1.200443] x5 : [PII_REDACTED] x4 : [PII_REDACTED] x3 :[PII_REDACTED]78616d
[    1.201339] x2 : [PII_REDACTED] x1 : ffff80008240b920 x0 : [PII_REDACTED]
[    1.202236] Call trace:
[    1.202545]  __pi_strcmp+0x24/0x140 (P)
[    1.203029]  mtk_soundcard_common_probe+0x3bc/0x5b8
[    1.203644]  platform_probe+0x70/0xe8
[    1.204106]  really_probe+0xc8/0x3a0
[    1.204556]  __driver_probe_device+0x84/0x160
[    1.205104]  driver_probe_device+0x44/0x130
[    1.205630]  __device_attach_driver+0xc4/0x170
[    1.206189]  bus_for_each_drv+0x8c/0xf8
[    1.206672]  __device_attach+0xa8/0x1c8
[    1.207155]  device_initial_probe+0x1c/0x30
[    1.207681]  bus_probe_device+0xb0/0xc0
[    1.208165]  deferred_probe_work_func+0xa4/0x100
[    1.208747]  process_one_work+0x158/0x3e0
[    1.209254]  worker_thread+0x2c4/0x3e8
[    1.209727]  kthread+0x134/0x1f0
[    1.210136]  ret_from_fork+0x10/0x20
[    1.210589] Code: 54000401 b50002c6 d503201f f86a6803 (f8408402)
[    1.211355] ---[ end trace [PII_REDACTED] ]---
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/183e7329d41d7a8e298f48b6b0eb81102a8654de; https://git.kernel.org/stable/c/7af317f7faaab09d5a78f24605057d11f5955115; https://git.kernel.org/stable/c/87dbfe2b392df9621f6e522e5fa6fb8849ca92ab