CVE-2025-37889

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ASoC: ops: Consistently treat platform_max as control value

This reverts commit 9bdd10d57a88 ("ASoC: ops: Shift tested values in

snd_soc_put_volsw() by +min"), and makes some additional related

updates.

There are two ways the platform_max could be interpreted; the maximum

register value, or the maximum value the control can be set to. The

patch moved from treating the value as a control value to a register

one. When the patch was applied it was technically correct as

snd_soc_limit_volume() also used the register interpretation. However,

even then most of the other usages treated platform_max as a

control value, and snd_soc_limit_volume() has since been updated to

also do so in commit fb9ad24485087 ("ASoC: ops: add correct range

check for limiting volume"). That patch however, missed updating

snd_soc_put_volsw() back to the control interpretation, and fixing

snd_soc_info_volsw_range(). The control interpretation make

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References