CVE-2025-38706

What it actually does

Null pointer dereference in snd_soc_remove_pcm_runtime() when called with rtd == NULL during module removal after topology loading marks a link as ignored due to missing hardware, resulting in kernel crash (availability impact only).

Why it matters to the business

Unexpected system crashes or instability on Linux kernels during audio driver unload or module removal in environments with optional or missing audio hardware components; widespread in embedded, container, and audio-enabled distributions increases operational downtime risk.

How an attack unfolds

An attacker with local access reproduces the condition by loading an ASoC topology that marks links as ignored (no runtime created) and then triggers module removal via soc_tplg_remove_link(), dereferencing the null pointer; listed threat actors reference related Linux kernel privilege escalation patterns on container-optimized OS but this specific flaw provides only denial-of-service.

How to fix it

Update to fixed versions: kustomize (MinimOS) 5.7.1-r0 or Linux kernel commit 8b465bedc2b417fd27c1d1ab7122882b4b60b1a0; apply the upstream patch that adds the rtd == NULL check before use.

How to confirm the fix worked

Verify kernel source or package version contains the NULL check in snd_soc_remove_pcm_runtime(); attempt reproduction with ignored-link topology loading followed by module removal and confirm no crash occurs.

Typical attack path

1. Obtain local access to a Linux system with ASoC audio support
2. Load custom topology that marks a link ignored due to absent hardware
3. Trigger module removal or driver unload path
4. snd_soc_remove_pcm_runtime() receives NULL rtd and crashes the kernel

How to detect it

Search kernel logs (dmesg, /var/log/kern.log, journalctl) for null pointer dereference or oops traces mentioning snd_soc_remove_pcm_runtime or soc_tplg_remove_link; correlate with recent module unload events or topology load attempts.

What your security team should do

• Prioritize patching Linux kernel packages on all affected systems within standard maintenance windows given low EPSS and local-only vector
• Audit audio topology configurations that use ignore flags for missing hardware
• Monitor for kernel oops/panic logs related to ASoC during module unload
• Apply the exact fixed commit or package version listed for each distribution