Critical NULL Pointer Dereference in Linux Kernel ASoC: imx-card Package
Summary
CVE-2025-22066: In the Linux kernel, the following vulnerability has been resolved: ASoC: imx-card: Add NULL check in imx_card_probe() devm_kasprintf() returns NULL when memory allocation fails. Affects linux versions < 6.1.135-1. Fixed in 6.1.135-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. The ASoC (ALSA System on Chip) subsystem is responsible for audio processing in embedded systems. The imx-card is a driver within this subsystem that facilitates audio functionality on i.MX processors. This vulnerability affects the imx-card driver, which is crucial for audio operations in devices utilizing the Linux kernel.
Vulnerability Detail
The vulnerability, identified as CVE-2025-22066, arises from a failure to check for NULL pointers after memory allocation in the imx_card_probe() function. Specifically, the devm_kasprintf() function can return NULL if memory allocation fails, leading to a NULL pointer dereference. This can result in a system crash or unexpected behavior, compromising the stability and reliability of the affected systems.
How To Fix
Minimum fixed version
6.1.135-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it becomes available.
Conclusion
CVE-2025-22066 is a critical vulnerability in the Linux kernel's ASoC: imx-card driver, which can lead to system instability due to a NULL pointer dereference. It is essential for users to update their systems to the patched version to mitigate this risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
CVE-2025-22066 is a vulnerability in the Linux kernel's ASoC: imx-card driver that can lead to a NULL pointer dereference due to a lack of NULL checks after memory allocation.
This vulnerability can cause system crashes or unexpected behavior, particularly in devices that rely on the imx-card driver for audio processing.
If you are using a version of the Linux kernel that includes the imx-card driver, you may be affected. You can check for vulnerabilities using the Vulert playground at Vulert Scanner.
The best protection is to update your Linux kernel package to the latest version that includes the fix for CVE-2025-22066.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using a manifest file like package-lock.json. It provides real-time alerts without requiring code access or installation.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
