A buffer overflow was discovered in the ASoC fs210x codec driver in the Linux kernel. The flaw originates from an incorrect use of the strscpy function, which copies a source string into a destination buffer based on the source length rather than the destination size. If the source string length is equal to or greater than the destination buffer size, the copy operation can overwrite adjacent memory, corrupting kernel data structures. This weakness (CWE-120) can compromise the integrity of critical kernel memory and potentially lead to kernel privilege escalation if an attacker can influence the data sent to the codec driver. The vulnerability was addressed by changing the strscpy call to use the size of the destination buffer, eliminating the overflow.

The flaw exists in any Linux kernel that contains the fs210x codec driver, which is part of the ASoC audio subsystem. The vendor list shows Linux:Linux, indicating the upstream kernel. No explicit version range is provided, so any kernel release that includes the unpatched fs210x code is affected until a patched release is installed.

The CVSS score of 7.8 indicates high severity for a kernel buffer overflow. The EPSS probability of less than 1% suggests that exploitation attempts are currently rare or not publicly known. The vulnerability is not listed in CISA KEV catalog. The likely attack vector involves feeding specially crafted data to the fs210x codec driver through user‑space audio applications or firmware; because the fault occurs in kernel space, a successful exploitation could corrupt kernel memory. Maintaining up‑to‑date kernel mitigates this risk.