CVE-2025-68345

What it actually does

Missing NULL check on return value of acpi_get_first_physical_node() and subsequent get_device() in cs35l41_hda_read_acpi() allows dereference of a NULL pointer, resulting in a kernel crash.

Why it matters to the business

Systems using affected Cirrus Logic audio hardware may experience unexpected kernel panics leading to reboots, temporary loss of audio functionality, and denial-of-service conditions; low EPSS and no KEV listing indicate limited real-world exploitation risk so far.

How an attack unfolds

An attacker with the ability to influence ACPI device enumeration or trigger audio driver initialization on vulnerable hardware causes the unchecked NULL return to be dereferenced inside the HDA codec probe path.

How to fix it

Update the Linux kernel to a version containing commit e63f9c81ca28b06eeeac3630faddc50717897351; apply the corresponding stable or distribution backport as soon as it becomes available.

How to confirm the fix worked

Confirm the running kernel contains the referenced commit hash or verify the source file cs35l41-hda.c includes the added NULL check before the get_device() call.

Typical attack path

1. Gain local access or control over ACPI tables on a system with cs35l41 hardware
2. Trigger audio subsystem initialization or HDA codec enumeration
3. Force acpi_get_first_physical_node() to return NULL
4. Dereference the resulting NULL pointer to induce kernel panic

How to detect it

Search kernel logs and crash dumps for stack traces containing cs35l41_hda_read_acpi and references to NULL pointer dereference during ACPI node handling.

• cs35l41_hda_read_acpi
• acpi_get_first_physical_node
• NULL pointer dereference in ALSA HDA cs35l41

What your security team should do

• Prioritize kernel updates on systems exposing the cs35l41 driver
• Monitor kernel logs for oops/panic entries referencing cs35l41_hda_read_acpi
• Test audio hardware functionality after patching to ensure driver stability