The Linux kernel's ASoC mediatek mt8195 driver had a flaw where the codec entry for the ETDM1_OUT_BE dai link was removed without properly replacing it with a COMP_EMPTY() entry. This caused the platforms array to be effectively empty, leading to a Kernel Address Sanitizer (KASAN) out-of-bounds warning in mtk_soundcard_common_probe() when the code accessed dai_link->platforms expecting at least one entry. The fix involved adding a COMP_EMPTY() entry to ensure the platforms array has the expected space, preventing out-of-bounds access.

This vulnerability allows local attackers with limited privileges (local vector, low complexity, low privileges required, no user interaction) to cause out-of-bounds memory access in the kernel sound subsystem. The CVSS score of 7.8 with high impact on confidentiality, integrity, and availability indicates potential for serious kernel memory corruption, which could lead to privilege escalation or denial of service.

A fix has been implemented in the Linux kernel by adding the missing COMP_EMPTY() platform entry for the ETDM1_OUT_BE dai link, correcting the platforms array size assumptions. Users should update to the fixed kernel version containing this patch. Patch status is not explicitly confirmed in the provided data; therefore, check the official Linux kernel advisories or vendor updates for the exact fixed versions and apply the official fix promptly.