NULL Pointer Dereference in Linux Kernel ASoC qcom Component

CVE-2025-39938

What is CVE-2025-39938?

In the Linux kernel's ASoC qcom component, a vulnerability exists that could lead to a NULL pointer dereference when the source graph fails to open correctly. If the audio processing subsystem rejects an incorrect audioreach topology, the ensuing operations continue despite the graph being set to NULL. This flaw can trigger a series of errors in the kernel, ultimately resulting in a system crash or unpredictable behavior during audio playback.

References