CVE-2025-37934 ASoC: simple-card-utils: Fix pointer check in graph_util_parse_link_direction
A missing pointer check in the Linux kernel's ASoC subsystem can lead to a null pointer dereference, causing a system crash.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-37934?
CVE-2025-37934 is a high-severity vulnerability in Linux kernel, published on 20 May 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ASoC: simple-card-utils: Fix pointer check in graph_util_parse_link_direction
Actually check if the passed pointers are valid, before writing to them. This also fixes a USBAN warning: UBSAN: invalid-load in ../sound/soc/fsl/imx-card.c:687:25 load of value 255 is not a valid value for type '_Bool'
This is because playback_only is uninitialized and is not written to, as the playback-only property is absent.
Which versions are affected by CVE-2025-37934?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-37934?
Apply the vendor's patch.
Is CVE-2025-37934 being exploited?
There is no known exploitation of CVE-2025-37934 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-37934, DEBIAN-CVE-2025-37934, GHSA-9c79-g7w7-vvhh, UBUNTU-CVE-2025-37934.