The Linux kernel’s ASoC driver for Spreadtrum devices contains an unchecked write operation in the compression routine. The driver allocates fixed‑size buffers—a 32 KB IRAM stage and a 2 MB DDR stage—but derives copy lengths from a user‑controlled fragment size and write count without validating them against the actual buffer capacities. An attacker can set a logical buffer size of up to roughly 4 GB through SNDRV_COMPRESS_SET_PARAMS, which enables the driver to copy data beyond the ends of the allocated buffers, corrupting kernel memory and potentially allowing escalation of privileges or denial of service.

Any Linux kernel build that includes the sprd_platform_compr_* code is affected. The flaw exists in the generic Linux kernel and in any vendor’s kernel that ships the Spreadtrum ASoC driver with the audio compression interface. No specific kernel version range is given, so any release containing the unpatched sprd driver is vulnerable.

The vulnerability has a CVSS score of 7.8 and is not listed in the CISA KEV catalog. The EPSS score is 0.00155, indicating a very low but non‑zero probability of exploitation. The attack does not require network connectivity or elevated privileges; a local user can trigger it by sending SNDRV_COMPRESS_SET_PARAMS to an audio device managed by the driver. Successful exploitation would overwrite kernel memory, giving the attacker the potential to gain higher privileges or crash the system. Because the bug is a classic out‑of‑bounds write, its likelihood of success is high if the driver is loaded.