PT-2025-27716 · Linux+3 · Linux Kernel+3

Published 2025-05-27 · Updated 2025-12-03 · CVE-2025-38130

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:L/AC:H/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified)

Description: A vulnerability in the Linux kernel has been resolved. The issue occurs when the sound/soc/codecs/hdmi-codec.c calls the plugged cb with NULL as the callback function and codec dev during driver removal. This causes the HDMI audio helper to attempt to call the null function pointer, resulting in an Oops. The fix involves only executing the callback if the function pointer is non-null.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2025-09608

CVE-2025-38130

USN-7769-1

USN-7769-2

USN-7769-3

USN-7770-1

USN-7771-1

USN-7789-1

USN-7789-2

Affected Products

Astra Linux

Linuxmint

Linux Kernel

Ubuntu

References · 212

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38130.json · Exploit
• https://git.kernel.org/stable/c/933f3eab1d489af8d734bff855b10d29dd5968a4 · Patch
• https://ubuntu.com/security/CVE-2025-38120 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38163 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38103 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38062 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38117 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38003 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38047 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-38130 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38272 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38295 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38059 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38102 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38068 · Vendor Advisory