CVE-2025-22066

What it actually does

Missing NULL check after devm_kasprintf() in imx_card_probe() allows a NULL pointer dereference when memory allocation fails, resulting in a kernel crash.

Why it matters to the business

Systems may experience unexpected kernel crashes during audio card initialization under memory pressure, leading to downtime on affected Linux devices; low exploitation likelihood reduces immediate risk despite wide kernel deployment.

How an attack unfolds

An attacker with local access triggers the imx_card_probe() path while the system is under memory exhaustion so that devm_kasprintf() returns NULL; the subsequent dereference without a check causes a kernel panic or denial of service.

How to fix it

Update the Linux kernel to the fixed commit 018e6cf2503e60087747b0ebc190e18b3640766f or later stable releases containing the NULL check after devm_kasprintf() in imx_card_probe().

How to confirm the fix worked

Confirm the presence of the NULL-pointer check after devm_kasprintf() in imx_card_probe() by inspecting the source or verifying the running kernel contains commit 018e6cf2503e60087747b0ebc190e18b3640766f; test probe under memory pressure to ensure no crash occurs.

Typical attack path

1. Gain local unprivileged access on target system
2. Exhaust kernel memory to force allocation failure
3. Trigger ALSA/imx-card device probe (e.g., via module load or hardware event)
4. Cause NULL dereference leading to kernel oops or panic

How to detect it

Search kernel logs and dmesg for imx_card_probe NULL pointer dereference oops or panic messages; correlate with low-memory conditions or recent audio device initialization events.

• imx_card_probe.*NULL pointer dereference
• devm_kasprintf.*returned NULL

What your security team should do

• Apply the kernel update containing the referenced commit as soon as feasible for the distribution
• Monitor kernel logs for imx-card related NULL dereference oops until patched
• Limit local unprivileged access on systems using imx audio cards