CVE-2025-37934

HIGH

Linux Kernel 6.11-6.12.27, 6.13-6.14.5 - Use-After-Free in ASoC Simple Card Utils

Title source: llm

Description

In the Linux kernel, the following vulnerability has been resolved: ASoC: simple-card-utils: Fix pointer check in graph_util_parse_link_direction Actually check if the passed pointers are valid, before writing to them. This also fixes a USBAN warning: UBSAN: invalid-load in ../sound/soc/fsl/imx-card.c:687:25 load of value 255 is not a valid value for type '_Bool' This is because playback_only is uninitialized and is not written to, as the playback-only property is absent.

References (3)

Core 3

Core References

Patch

https://git.kernel.org/stable/c/b41a49d5435e0f76da320f231b7252800e8f736f

Patch

https://git.kernel.org/stable/c/9b5b3088c4d1752253491705919bd7d067964288

Patch

https://git.kernel.org/stable/c/3cc393d2232ec770b5f79bf0673d67702a3536c3

Scores

CVSS v3 7.8

EPSS 0.0017

EPSS Percentile 6.9%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

Status published

Products (12)

linux/Kernel 6.11.0 - 6.12.28linux

linux/Kernel 6.13.0 - 6.14.6linux

Linux/Linux < 6.11

Linux/Linux 6.11

Linux/Linux 6.12.28 - 6.12.*

Linux/Linux 6.14.6 - 6.14.*

Linux/Linux 6.15

Linux/Linux 844de7eebe97a1c277f8a408457712086c957195 - 3cc393d2232ec770b5f79bf0673d67702a3536c3

Linux/Linux 844de7eebe97a1c277f8a408457712086c957195 - 9b5b3088c4d1752253491705919bd7d067964288

Linux/Linux 844de7eebe97a1c277f8a408457712086c957195 - b41a49d5435e0f76da320f231b7252800e8f736f

... and 2 more

Published May 20, 2025

Tracked Since Feb 18, 2026