# CVE-2023-54245: ASoC: codecs: tx-macro: Fix for KASAN: slab-out-of-bounds

> A slab-out-of-bounds read in the Linux kernel tx-macro codec allows local attackers to cause denial of service or potentially execute code.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 30 Dec 2025
- **Updated:** 11 May 2026
- **Also known as:** BELL-CVE-2023-54245, DEBIAN-CVE-2023-54245, GHSA-5782-r2xr-5rq2, UBUNTU-CVE-2023-54245

## What is CVE-2023-54245?

CVE-2023-54245 is a memory corruption vulnerability in Linux, published on 30 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

ASoC: codecs: tx-macro: Fix for KASAN: slab-out-of-bounds

When we run syzkaller we get below Out of Bound.
    "KASAN: slab-out-of-bounds Read in regcache_flat_read"

    Below is the backtrace of the issue:

    dump_backtrace+0x0/0x4c8
    show_stack+0x34/0x44
    dump_stack_lvl+0xd8/0x118
    print_address_description+0x30/0x2d8
    kasan_report+0x158/0x198
    __asan_report_load4_noabort+0x44/0x50
    regcache_flat_read+0x10c/0x110
    regcache_read+0xf4/0x180
    _regmap_read+0xc4/0x278
    _regmap_update_bits+0x130/0x290
    regmap_update_bits_base+0xc0/0x15c
    snd_soc_component_update_bits+0xa8/0x22c
    snd_soc_component_write_field+0x68/0xd4
    tx_macro_digital_mute+0xec/0x140

    Actually There is no need to have decimator with 32 bits.
    By limiting the variable with short type u8 issue is resolved.

## Which versions are affected by CVE-2023-54245?


## How do I fix CVE-2023-54245?

Apply the vendor's patch.

## Is CVE-2023-54245 being exploited?

There is no known exploitation of CVE-2023-54245 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2023-54245 and fix it if it is affected.

What it is: CVE-2023-54245 is a memory corruption vulnerability in Linux, published on 30 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2023-54245 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2023-54245/ (Markdown: https://insights.sbomify.com/CVE-2023-54245/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2023-54245
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-54245
- OSV: https://osv.dev/vulnerability/CVE-2023-54245

---
From sbomify Insights: https://insights.sbomify.com/CVE-2023-54245/
Summaries are generated and may contain mistakes; the official description above is the record.