« Volver al listado

CVE-2025-38130

Estado: AnalizadaMedia (5.5)—

In the Linux kernel, the following vulnerability has been resolved:

drm/connector: only call HDMI audio helper plugged cb if non-null

On driver remove, sound/soc/codecs/hdmi-codec.c calls the plugged_cb with NULL as the callback function and codec_dev, as seen in its hdmi_remove function.

The HDMI audio helper then happily tries calling said null function pointer, and produces an Oops as a result.

Fix this by only executing the callback if fn is non-null. This means the .plugged_cb and .plugged_cb_dev members still get appropriately cleared.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Linux — Linux Kernel

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-38130",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "baf616647fe6f857a0cf2187197de31e9bb17a71",
              "lessThan": "933f3eab1d489af8d734bff855b10d29dd5968a4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "baf616647fe6f857a0cf2187197de31e9bb17a71",
              "lessThan": "be9b3f9a54101c19226c25ba7163d291183777a0",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/gpu/drm/display/drm_hdmi_audio_helper.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.14",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.15.3",
              "versionType": "semver",
              "lessThanOrEqual": "6.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/gpu/drm/display/drm_hdmi_audio_helper.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-07-03T09:15:27.303",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/933f3eab1d489af8d734bff855b10d29dd5968a4",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/be9b3f9a54101c19226c25ba7163d291183777a0",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-476"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/connector: only call HDMI audio helper plugged cb if non-null\n\nOn driver remove, sound/soc/codecs/hdmi-codec.c calls the plugged_cb\nwith NULL as the callback function and codec_dev, as seen in its\nhdmi_remove function.\n\nThe HDMI audio helper then happily tries calling said null function\npointer, and produces an Oops as a result.\n\nFix this by only executing the callback if fn is non-null. This means\nthe .plugged_cb and .plugged_cb_dev members still get appropriately\ncleared."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/connector: solo se llama al auxiliar de audio HDMI plugged cb si no es nulo. Al eliminar el controlador, sound/soc/codecs/hdmi-codec.c llama a plugged_cb con NULL como función de devolución de llamada y codec_dev, como se observa en su función hdmi_remove. El auxiliar de audio HDMI intenta entonces llamar a dicho puntero de función nulo, pero produce un error. Para solucionar esto, ejecute la devolución de llamada solo si fn no es nulo. Esto significa que los miembros .plugged_cb y .plugged_cb_dev se borran correctamente."
    }
  ],
  "lastModified": "2026-06-17T09:16:07.020",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "59623E70-FBCF-4F5B-A3CE-07A4482CED29",
              "versionEndExcluding": "6.15.3",
              "versionStartIncluding": "6.14"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}