CVE-2025-38706
Medium
Description
In the Linux kernel, the following vulnerability has been resolved: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() snd_soc_remove_pcm_runtime() might be called with rtd == NULL which will leads to null pointer dereference. This was reproduced with topology loading and marking a link as ignore due to missing hardware component on the system. On module removal the soc_tplg_remove_link() would call snd_soc_remove_pcm_runtime() with rtd == NULL since the link was ignored, no runtime was created.
SeverityMedium
CVSS5.5
Exploit probability—
Product
Linux Kernel
PublishedSep 4, 2025
First seenSep 4, 2025
Weakness typeCWE-476NULL pointer dereference
How to fix
Update
- linux linux_kernel5.10.241, 5.15.190, 6.1.149, 6.6.103, 6.12.43, 6.15.11, 6.16.2 or later
Patches
- git.kernel.org/stable/c/2d91cb261cac6d885954b8f5da28b5c176c18131
- git.kernel.org/stable/c/2fce20decc6a83f16dd73744150c4e7ea6c97c21
- git.kernel.org/stable/c/41f53afe53a57a7c50323f99424b598190acf192
- git.kernel.org/stable/c/7ce0a7255ce97ed7c54afae83fdbce712a1f0c9e
- git.kernel.org/stable/c/7f8fc03712194fd4e2df28af7f7f7a38205934ef
- git.kernel.org/stable/c/82ba7b8cf9f6e3bf392a9f08ba3d1c0b200ccb94
- git.kernel.org/stable/c/8b465bedc2b417fd27c1d1ab7122882b4b60b1a0
- git.kernel.org/stable/c/cecc65827ef3df9754e097582d89569139e6cd1e
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | 5.6 ≤ v < 5.10.241, 5.11 ≤ v < 5.15.190, 5.16 ≤ v < 6.1.149, 6.2 ≤ v < 6.6.103, 6.7 ≤ v < 6.12.43, 6.13 ≤ v < 6.15.11, 6.16 ≤ v < 6.16.2 | 5.10.241, 5.15.190, 6.1.149, 6.6.103, 6.12.43, 6.15.11, 6.16.2 |
| debian debian_linux | 11.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.