CVE-2025-40154

A flaw was found in the Linux kernel’s ASoC Intel bytcr_rt5640 driver. When an invalid value is passed via the driver’s “quirk” input option, the driver merely logs an error and retains the invalid value, rather than correcting it. This can result in out-of-bounds (OOB) memory access.

This vulnerability is rated as having a Moderate impact because exploitation requires local access, specific hardware, and the ability to pass custom driver parameters. The issue is confined to the Intel Baytrail audio machine driver with the Realtek RT5640 codec, a platform not typically utilized in enterprise server deployments. Furthermore, triggering the out-of-bounds access depends on supplying an invalid quirk parameter during driver initialization rather than occurring in standard runtime operations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent module snd-soc-core from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.