CVE-2025-38706: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime()
In the Linux kernel, the following vulnerability has been resolved:
ASoC: core: Check for rtd == NULL in sndsocremovepcmruntime()
sndsocremovepcmruntime() might be called with rtd == NULL which will leads to null pointer dereference. This was reproduced with topology loading and marking a link as ignore due to missing hardware component on the system. On module removal the soctplgremovelink() would call sndsocremovepcmruntime() with rtd == NULL since the link was ignored, no runtime was created.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38706?
CVE-2025-38706 is considered a critical vulnerability due to the potential for null pointer dereference in the Linux kernel.
How do I fix CVE-2025-38706?
To fix CVE-2025-38706, ensure that you update your Linux kernel to the latest stable version where this vulnerability has been patched.
What systems are affected by CVE-2025-38706?
CVE-2025-38706 affects the Linux kernel, specifically in the context of ASoC (ALSA System on Chip) operations.
What happens if CVE-2025-38706 is exploited?
Exploitation of CVE-2025-38706 can lead to a system crash or a denial of service due to a null pointer dereference.
How can I determine if my system is vulnerable to CVE-2025-38706?
You can determine if your system is vulnerable to CVE-2025-38706 by checking your current Linux kernel version against the patched versions noted by the Linux kernel community.