CVE-2025-39938 ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed
A NULL pointer dereference in the Qualcomm audio driver causes a kernel crash when source graph initialization fails, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-39938?
CVE-2025-39938 is a medium-severity vulnerability in Linux kernel, published on 4 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed
If earlier opening of source graph fails (e.g. ADSP rejects due to incorrect audioreach topology), the graph is closed and "dai_data->graph[dai->id]" is assigned NULL. Preparing the DAI for sink graph continues though and next call to q6apm_lpass_dai_prepare() receives dai_data->graph[dai->id]=NULL leading to NULL pointer exception:
qcom-apm gprsvc:service:2:1: Error (1) Processing 0x01001002 cmd qcom-apm gprsvc:service:2:1: DSP returned error[1001002] 1 q6apm-lpass-dais 30000000.remoteproc:glink-edge:gpr:service@1:bedais: fail to start APM port 78 q6apm-lpass-dais 30000000.remoteproc:glink-edge:gpr:service@1:bedais: ASoC: error at snd_soc_pcm_dai_prepare on TX_CODEC_DMA_TX_3: -22 Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a8 ... Call trace: q6apm_graph_media_format_pcm+0x48/0x120 (P) q6apm_lpass_dai_prepare+0x110/0x1b4 snd_soc_pcm_dai_prepare+0x74/0x108 __soc_pcm_prepare+0x44/0x160 dpcm_be_dai_prepare+0x124/0x1c0
Weakness: CWE-476
Which versions are affected by CVE-2025-39938?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-39938?
Apply the vendor's patch.
Is CVE-2025-39938 being exploited?
There is no known exploitation of CVE-2025-39938 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-68135, BELL-CVE-2025-39938, DEBIAN-CVE-2025-39938, GHSA-p2vv-2726-r3pr, ROOT-OS-DEBIAN-12-CVE-2025-39938, ROOT-OS-DEBIAN-13-CVE-2025-39938 and 2 more.