CVE-2025-38454: ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp()
In the Linux kernel, the following vulnerability has been resolved:
ALSA: ad1816a: Fix potential NULL pointer deref in sndcardad1816apnp()
Use prwarn() instead of devwarn() when 'pdev' is NULL to avoid a potential NULL pointer dereference.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
In snd_card_ad1816a_pnp(), use pr_warn() instead of dev_warn() when 'pdev' is NULL to avoid a potential NULL pointer dereference.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38454?
CVE-2025-38454 has a medium severity rating due to the potential for a NULL pointer dereference.
How do I fix CVE-2025-38454?
Fixing CVE-2025-38454 involves updating the Linux kernel to the latest version where this vulnerability has been patched.
What components are affected by CVE-2025-38454?
CVE-2025-38454 affects the ALSA subsystem, specifically the ad1816a driver in the Linux kernel.
Can CVE-2025-38454 be exploited remotely?
CVE-2025-38454 does not appear to be exploitable remotely as it relates to a local kernel driver issue.
What does the fix for CVE-2025-38454 involve?
The fix for CVE-2025-38454 involves changing the logging from dev_warn() to pr_warn() when the 'pdev' is NULL.