CVE-2026-72257

Received Received - Intake

NULL Pointer Dereference in Linux Kernel ASoC q6apm Driver

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback When q6apm_free_fragments() is called it frees rx_data.buf/tx_data.buf and sets them to NULL under graph->lock. A late DSP buffer-done response can race with this: graph_callback() passes the !graph->ar_graph guard (not yet NULL), acquires the lock, but then dereferences a now-NULL buf pointer to read buf[token].phys, crashing at virtual address 0x10. Add a NULL check for buf inside the mutex-protected section in both the write-done (DATA_CMD_RSP_WR_SH_MEM_EP_DATA_BUFFER_DONE_V2) and read-done (DATA_CMD_RSP_RD_SH_MEM_EP_DATA_BUFFER_V2) handlers and bail out cleanly if buffers have already been freed. This problem is only shown up recently while apr bus was updated to process the commands per service rather from single global queue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72257

EUVD

EUVD-2026-59156

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a NULL pointer dereference vulnerability in the Linux kernel's ASoC (ALSA System on Chip) subsystem for Qualcomm platforms. It occurs in the q6apm driver when handling DSP buffer responses. The issue arises when a late DSP buffer-done response races with the freeing of buffers, causing a crash when the code tries to access a NULL pointer.

Detection Guidance

This vulnerability is specific to the Linux kernel's ASoC subsystem and involves a race condition in the q6apm driver. Detection requires checking kernel logs for NULL pointer dereference crashes in the q6apm module. Look for kernel oops messages or crashes related to buffer handling in the ASoC subsystem.

Impact Analysis

This vulnerability can cause a system crash (kernel panic) when specific audio-related operations are performed on Qualcomm-based systems using the affected Linux kernel. It may lead to denial of service, requiring a reboot to restore functionality.

Compliance Impact

This vulnerability is a NULL pointer dereference in the Linux kernel's ASoC subsystem, specifically in the qcom q6apm driver. It does not directly relate to data privacy, security controls, or compliance requirements such as GDPR or HIPAA, which focus on unauthorized data access, processing, or disclosure. The issue causes a system crash but does not expose or leak sensitive data.

Mitigation Strategies

Apply the latest kernel patches or updates that include the fix for this specific issue. If immediate patching is not possible, consider disabling the affected q6apm driver or restricting access to the DSP buffer handling functionality until the patch can be applied.

Hi! I’m here to help you understand CVE-2026-72257. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70