Null Pointer Dereference in Linux Kernel - ASoC Core Vulnerability
Summary
CVE-2025-38706: In the Linux kernel, the following vulnerability has been resolved: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() snd_soc_remove_pcm_runtime() might be called with rtd == NULL which will leads to null... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interactions. It is known for its robustness and versatility, supporting a wide range of devices and architectures. However, like any complex software, it is susceptible to vulnerabilities that can compromise system stability and security. This specific vulnerability affects the ASoC (ALSA System on Chip) core, which is responsible for managing audio devices in embedded systems.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the ASoC core where the function snd_soc_remove_pcm_runtime() can be called with a null pointer (rtd == NULL). This situation arises when a link is marked as ignored due to a missing hardware component, leading to a null pointer dereference. This can cause system crashes or unexpected behavior when the module is removed, as the function attempts to operate on a non-existent runtime.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is advisable to ensure that all hardware components are correctly configured to avoid triggering the null pointer dereference.
Conclusion
The identified vulnerability in the Linux kernel's ASoC core poses a risk of null pointer dereference, potentially leading to system instability. It is crucial for users to update their systems to the patched versions to mitigate this risk. Regular monitoring and proper hardware configuration can help in managing the impact of such vulnerabilities.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to system crashes or unexpected behavior when the snd_soc_remove_pcm_runtime() function is called with a null pointer.
All versions of the Linux kernel prior to the patched versions (6.12.43-1 for Debian 13 and 6.16.3-1 for Debian 14) are affected.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Currently, there are no specific workarounds available. It is best to ensure proper hardware configuration to avoid triggering the vulnerability.
If an immediate update is not possible, monitor your system for any unusual behavior and consider isolating the affected components until a patch can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
