CVE-2025-38070

ASoC: sma1307: Add NULL check in sma1307_setting_loaded()

At a glance

Severity: Not available
EPSS: EPSS 0.15 % · percentile 4 (2026-10-27)
State: PUBLISHED
Published: 2025-06-18
Updated: 2026-05-11
Assigner: Linux
NVD status: Analyzed

Description

In the Linux kernel, the following vulnerability has been resolved: ASoC: sma1307: Add NULL check in sma1307_setting_loaded() All varibale allocated by kzalloc and devm_kzalloc could be NULL. Multiple pointer checks and their cleanup are added. This issue is found by our static analysis tool

Scores

Version	Score	Vector	Scored by
CVSS 3.1	MEDIUM 5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	NVD · nvd@nist.gov (Primary)

Weaknesses (CWE)

CWE-476

European references

ENISA EUVD · EUVD-2025-18583
GCVE · GCVE-0-2025-38070

CERT-FR advisories

CERTFR-2026-AVI-0326 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
CERTFR-2026-AVI-0316 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
CERTFR-2025-AVI-0859 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
CERTFR-2025-AVI-0843 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
CERTFR-2025-AVI-0828 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* ≥ 6.13 < 6.14.9

Affected products

Product	Versions
Linux · Linux	affected 576c57e6b4c1d734bcb7cc33dde9a99a9383b520 < f8434b8ba437d3f6cbcd9ffe8405bd16ed28fc5c ; affected 576c57e6b4c1d734bcb7cc33dde9a99a9383b520 < 0ec6bd16705fe21d6429d6b8f7981eae2142bba8
Linux · Linux	affected 6.13 ; unaffected 0 < 6.13 ; unaffected 6.14.9 ≤ 6.14.* ; unaffected 6.15 ≤ *

References

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD