CVE-2025-38706 Details
Description
In the Linux kernel, the following vulnerability has been resolved: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() snd_soc_remove_pcm_runtime() might be called with rtd == NULL which will leads to null pointer dereference. This was reproduced with topology loading and marking a link as ignore due to missing hardware component on the system. On module removal the soc_tplg_remove_link() would call snd_soc_remove_pcm_runtime() with rtd == NULL since the link was ignored, no runtime was created.
A null pointer dereference vulnerability has been identified in the Linux kernel's ASoC (ALSA System on Chip) component. The issue arises in the snd_soc_remove_pcm_runtime() function, which can be called with a NULL runtime pointer (rtd). This vulnerability was reproduced by loading a topology that ignored a link due to a missing hardware component, resulting in no runtime being created. When the module was removed, the soc_tplg_remove_link() function called snd_soc_remove_pcm_runtime() with rtd set to NULL, leading to the null pointer dereference.
The vulnerability has been addressed in the official Linux Git repository. Users can upgrade to the latest version to mitigate this issue.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cert-portal.siemens.com/productcert/html/ssa-032379.html | siemens-SADP | |
| https://git.kernel.org/stable/c/2d91cb261cac6d885954b8f5da28b5c176c18131 | kernel.org | Patch |
| https://git.kernel.org/stable/c/2fce20decc6a83f16dd73744150c4e7ea6c97c21 | kernel.org | Patch |
| https://git.kernel.org/stable/c/41f53afe53a57a7c50323f99424b598190acf192 | kernel.org | Patch |
| https://git.kernel.org/stable/c/7ce0a7255ce97ed7c54afae83fdbce712a1f0c9e | kernel.org | Patch |
| https://git.kernel.org/stable/c/7f8fc03712194fd4e2df28af7f7f7a38205934ef | kernel.org | Patch |
| https://git.kernel.org/stable/c/82ba7b8cf9f6e3bf392a9f08ba3d1c0b200ccb94 | kernel.org | Patch |
| https://git.kernel.org/stable/c/8b465bedc2b417fd27c1d1ab7122882b4b60b1a0 | kernel.org | Patch |
| https://git.kernel.org/stable/c/cecc65827ef3df9754e097582d89569139e6cd1e | kernel.org | Patch |
| https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html | CVE | Third Party Advisory |
| https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html | CVE | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 5.6, < 5.10.241 >= 5.11, < 5.15.190 >= 5.16, < 6.1.149 >= 6.2, < 6.6.103 >= 6.7, < 6.12.43 >= 6.13, < 6.15.11 >= 6.16, < 6.16.2 |
CPE
Remediation
| |
| debian debian linux | 11.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jun 17, 2026 | CVE Modified | siemens-SADP |
| May 12, 2026 | CVE Modified | siemens-SADP |
| Jan 23, 2026 | Initial Analysis | [email protected] |
| Nov 3, 2025 | CVE Modified | CVE |
| Sep 4, 2025 | New CVE Received | kernel.org |