Security readout for executives and security teams
Plain-English summary
A Linux audio driver for Qualcomm SC7280 systems can access memory outside an expected array when processing certain audio port identifiers. A local user with limited privileges may be able to trigger serious confidentiality, integrity, or availability impacts. Exposure is hardware and driver dependent, so general-purpose Linux systems without this Qualcomm audio path are unlikely to be affected.
Executive priority
Treat this as a high-priority, platform-specific kernel update. Rapidly identify SC7280-based systems, especially shared or user-accessible devices, then apply supported kernel updates. It is less urgent for systems confirmed not to use the affected Qualcomm audio driver. No active exploitation is established by the supplied evidence.
Technical view
The SC7280 ASoC LPASS driver used q6dsp port identifiers that exceeded arrays sized by LPASS_MAX_PORTS. Cases added with AudioReach support could therefore cause out-of-bounds access, including RX_CODEC_DMA_RX_0 in sc7280_snd_hw_params(). The upstream correction expands LPASS_MAX_PORTS to cover the maximum relevant port identifier.
Likely exposure
Likely exposure is limited to affected Linux kernels running on Qualcomm SC7280 platforms where the relevant LPASS AudioReach driver is present and usable. The supplied version data is ambiguous, so kernel version alone should not determine exposure; confirm the distributor package or source contains the applicable stable fix.
Exploitation context
The CVSS 3.1 vector scores this 7.8 and indicates local access, low privileges, low complexity, and no user interaction. The bundle marks KEV false and provides no evidence of active exploitation or a public exploit. Practical reachability and impact have not been demonstrated in the supplied sources.
Researcher notes
The issue was found by Linux Verification Center using SVACE and traces to AudioReach support introduced by commit 5f78e1fb7a3e. No CWE was supplied. The provided affected-version list contains duplicated commit values and ambiguous release boundaries; use branch-specific stable commits and distributor package metadata rather than inferring a universal fixed version.
Mitigation direction
- Install a vendor-supported kernel containing the applicable upstream stable fix.
- Check Linux distributor advisories for the corrected package version for each deployed branch.
- Prioritize Qualcomm SC7280 devices exposing the affected audio driver to local users.
- Restrict untrusted local access where prompt kernel updates are unavailable.
Validation and detection
- Inventory Qualcomm SC7280 devices and their running kernel packages.
- Confirm whether the SC7280 LPASS AudioReach driver is built, loaded, or otherwise reachable.
- Compare each kernel package against its vendor advisory or applicable stable fix commit.
- After updating, verify the running kernel is the corrected package and reassess driver exposure.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-37979 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/d78888853eb53f47ae16cf3aa5d0444d0331b9f8CVE reference, Linux
- https://git.kernel.org/stable/c/a12c14577882b1f2b4cff0f86265682f16e97b0cCVE reference, Linux
- https://git.kernel.org/stable/c/c0ce01e0ff8a0d61a7b089ab309cdc12bc527c39CVE reference, Linux
- https://git.kernel.org/stable/c/b807b7c81a6d066757a94af7b8fa5b6a37e4d0b3CVE reference, Linux
- https://git.kernel.org/stable/c/a31a4934b31faea76e735bab17e63d02fcd8e029CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.