CVE-2025-38070

What it actually does

Missing NULL pointer checks after kzalloc and devm_kzalloc calls in sma1307_setting_loaded() allow potential dereference of NULL pointers in the ASoC audio driver.

Why it matters to the business

Kernel instability or crashes in systems using the affected audio codec driver can interrupt operations and require restarts, with higher urgency for devices on older kernels given the 496 days since disclosure.

How an attack unfolds

An attacker triggers memory allocation pressure or failure paths in the sma1307 driver to reach the unchecked pointers, causing NULL dereference during device initialization or configuration loading.

How to fix it

Apply the upstream fix commit f8434b8ba437d3f6cbcd9ffe8405bd16ed28fc5c or later; update affected packages such as qemu to 2.1.3-2.7.mga5 or equivalent stable kernel releases containing the NULL checks and cleanup logic.

How to confirm the fix worked

Verify the presence of the added pointer checks and kzalloc/devm_kzalloc NULL handling in sma1307_setting_loaded() by inspecting source or confirming the applied commit; test driver load under memory pressure to ensure no crashes occur.

Typical attack path

1. Identify a target system with the vulnerable sma1307 ASoC driver loaded
2. Induce allocation failures via resource exhaustion or crafted audio device events
3. Invoke sma1307_setting_loaded() to dereference unvalidated pointers
4. Trigger kernel oops or panic for denial of service

How to detect it

Review kernel logs for oops or panic entries referencing sma1307_setting_loaded or NULL dereferences during audio device probe; correlate with allocation failure events in dmesg or ftrace.

What your security team should do

• Prioritize kernel updates on audio-enabled systems within the next patching cycle
• Monitor EPSS trend and re-evaluate if exploitation maturity increases
• Audit custom kernels for backported fixes matching the referenced commit