linux-cve-announce - CVE-2025-38706: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025090455-CVE-2025-38706-da55@gregkh>
Date: Thu,  4 Sep 2025 17:33:11 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-38706: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime()

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime()

snd_soc_remove_pcm_runtime() might be called with rtd == NULL which will
leads to null pointer dereference.
This was reproduced with topology loading and marking a link as ignore
due to missing hardware component on the system.
On module removal the soc_tplg_remove_link() would call
snd_soc_remove_pcm_runtime() with rtd == NULL since the link was ignored,
no runtime was created.

The Linux kernel CVE team has assigned CVE-2025-38706 to this issue.


Affected and fixed versions
===========================

	Fixed in 5.10.241 with commit 8b465bedc2b417fd27c1d1ab7122882b4b60b1a0
	Fixed in 5.15.190 with commit 82ba7b8cf9f6e3bf392a9f08ba3d1c0b200ccb94
	Fixed in 6.1.149 with commit 7f8fc03712194fd4e2df28af7f7f7a38205934ef
	Fixed in 6.6.103 with commit 41f53afe53a57a7c50323f99424b598190acf192
	Fixed in 6.12.43 with commit 2fce20decc6a83f16dd73744150c4e7ea6c97c21
	Fixed in 6.15.11 with commit cecc65827ef3df9754e097582d89569139e6cd1e
	Fixed in 6.16.2 with commit 7ce0a7255ce97ed7c54afae83fdbce712a1f0c9e
	Fixed in 6.17-rc1 with commit 2d91cb261cac6d885954b8f5da28b5c176c18131

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-38706
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	sound/soc/soc-core.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/8b465bedc2b417fd27c1d1ab7122882b4b60b1a0
	https://git.kernel.org/stable/c/82ba7b8cf9f6e3bf392a9f08ba3d1c0b200ccb94
	https://git.kernel.org/stable/c/7f8fc03712194fd4e2df28af7f7f7a38205934ef
	https://git.kernel.org/stable/c/41f53afe53a57a7c50323f99424b598190acf192
	https://git.kernel.org/stable/c/2fce20decc6a83f16dd73744150c4e7ea6c97c21
	https://git.kernel.org/stable/c/cecc65827ef3df9754e097582d89569139e6cd1e
	https://git.kernel.org/stable/c/7ce0a7255ce97ed7c54afae83fdbce712a1f0c9e
	https://git.kernel.org/stable/c/2d91cb261cac6d885954b8f5da28b5c176c18131