CVE-2025-38706

MEDIUM

MEDIUM Priority: 0.01 BB Relevance: 36/100

Published: 2025-09-04 Modified: 2026-11-05 First seen: 2026-11-05 Status: active

Attack Surface

Low Complexity No Interaction

CVSS Vector Breakdown

AV: Local

AC: Low

PR: Low

UI: None

S: Unchanged

C: None

I: None

A: High

Description

In the Linux kernel, the following vulnerability has been resolved: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() snd_soc_remove_pcm_runtime() might be called with rtd == NULL which will leads to null pointer dereference. This was reproduced with topology loading and marking a link as ignore due to missing hardware component on the system. On module removal the soc_tplg_remove_link() would call snd_soc_remove_pcm_runtime() with rtd == NULL since the link was ignored, no runtime was created.

Weakness Classification (1)

CWE-476

Affected Software (11)

Vendor	Product	Version
Linux	Linux	50cd9b5317d5593d0a33f4227f56ddcc1bf66604 < 8b465bedc2b417fd27c1d1ab7122882b4b60b1a0
Linux	Linux	50cd9b5317d5593d0a33f4227f56ddcc1bf66604 < 82ba7b8cf9f6e3bf392a9f08ba3d1c0b200ccb94
Linux	Linux	50cd9b5317d5593d0a33f4227f56ddcc1bf66604 < 7f8fc03712194fd4e2df28af7f7f7a38205934ef
Linux	Linux	50cd9b5317d5593d0a33f4227f56ddcc1bf66604 < 41f53afe53a57a7c50323f99424b598190acf192
Linux	Linux	50cd9b5317d5593d0a33f4227f56ddcc1bf66604 < 2fce20decc6a83f16dd73744150c4e7ea6c97c21
Linux	Linux	50cd9b5317d5593d0a33f4227f56ddcc1bf66604 < cecc65827ef3df9754e097582d89569139e6cd1e
Linux	Linux	50cd9b5317d5593d0a33f4227f56ddcc1bf66604 < 7ce0a7255ce97ed7c54afae83fdbce712a1f0c9e
Linux	Linux	50cd9b5317d5593d0a33f4227f56ddcc1bf66604 < 2d91cb261cac6d885954b8f5da28b5c176c18131
Linux	Linux	5.6
debian	debian_linux	11.0
linux	linux_kernel	5.6 – 5.10.241