CVE-2025-38573

In the Linux kernel, the following vulnerability has been resolved:

spi: cs42l43: Property entry should be a null-terminated array

The software node does not specify a count of property entries, so the array must be null-terminated.

When unterminated, this can lead to a fault in the downstream cs35l56 amplifier driver, because the node parse walks off the end of the array into unknown memory.

A LOW severity flaw was found in the Linux kernel SPI driver for the Cirrus Logic cs42l43 codec. The software node used to describe the device does not specify a count of property entries, so the property entry array must be null-terminated. When the array is left unterminated, parsing the node can walk off the end of the array into unknown memory, which can cause a fault in the downstream cs35l56 amplifier driver. Red Hat assesses the impact of this flaw as LOW (CVSS 4.4, AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) because it is a local issue that requires high privileges and affects availability only; the higher NIST (5.5) and CVE.org (7.3) scores overstate the impact, since the CVE.org vector's confidentiality and integrity impacts are not supported by the underlying out-of-bounds access, which leads to a fault rather than data exposure or modification. The Red Hat Enterprise Linux 10 kernel is affected and the fix is currently deferred; the residual risk is limited to a kernel fault on systems that use the affected cs42l43/cs35l56 audio hardware. Red Hat Enterprise Linux 6, 7, 8, and 9 kernel and kernel-rt streams and Red Hat In-Vehicle OS 1 are not affected because the vulnerable code is not present in those kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.