CVE-2025-37889

ASoC: ops: Consistently treat platform_max as control value

published May 9, 2025

CVSS
—
EPSS
0%
Percentile
19.6
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

ASoC: ops: Consistently treat platform_max as control value

This reverts commit 9bdd10d57a88 ("ASoC: ops: Shift tested values in

snd_soc_put_volsw() by +min"), and makes some additional related

updates.

There are two ways the platform_max could be interpreted; the maximum

register value, or the maximum value the control can be set to. The

patch moved from treating the value as a control value to a register

one. When the patch was applied it was technically correct as

snd_soc_limit_volume() also used the register interpretation. However,

even then most of the other usages treated platform_max as a

control value, and snd_soc_limit_volume() has since been updated to

also do so in commit fb9ad24485087 ("ASoC: ops: add correct range

check for limiting volume"). That patch however, missed updating

snd_soc_put_volsw() back to the control interpretation, and fixing

snd_soc_info_volsw_range(). The control interpretation makes more

sense as limiting is typically done from the machine driver, so it is

appropriate to use the customer facing representation rather than the

internal codec representation. Update all the code to consistently use

this interpretation of platform_max.

Finally, also add some comments to the soc_mixer_control struct to

hopefully avoid further patches switching between the two approaches.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00282 · 19.6th percentile
Published
2025-05-09T06:45Z
EPSS history
Timeline
  • 09 MAY 06:45Z
    ASoC: ops: Consistently treat platform_max as control value
    cvelistv5