CVE-2026-72257 (GCVE-0-2026-72257)
Vulnerability from cvelistv5
Published
2026-08-15 05:54
Modified
2026-08-17 05:11
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback
When q6apm_free_fragments() is called it frees rx_data.buf/tx_data.buf
and sets them to NULL under graph->lock. A late DSP buffer-done response
can race with this: graph_callback() passes the !graph->ar_graph guard
(not yet NULL), acquires the lock, but then dereferences a now-NULL buf
pointer to read buf[token].phys, crashing at virtual address 0x10.
Add a NULL check for buf inside the mutex-protected section in both the
write-done (DATA_CMD_RSP_WR_SH_MEM_EP_DATA_BUFFER_DONE_V2) and
read-done (DATA_CMD_RSP_RD_SH_MEM_EP_DATA_BUFFER_V2) handlers and bail
out cleanly if buffers have already been freed.
This problem is only shown up recently while apr bus was updated to
process the commands per service rather from single global queue.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 5477518b8a0e8a45239646acd80c9bafc4401522 Version: 5477518b8a0e8a45239646acd80c9bafc4401522 Version: 5477518b8a0e8a45239646acd80c9bafc4401522 Version: 5477518b8a0e8a45239646acd80c9bafc4401522 Version: 5477518b8a0e8a45239646acd80c9bafc4401522 Version: 5477518b8a0e8a45239646acd80c9bafc4401522 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/soc/qcom/qdsp6/q6apm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a164e744d8de1c41049bd9a1452a4b6bbf5bd8bc",
"status": "affected",
"version": "5477518b8a0e8a45239646acd80c9bafc4401522",
"versionType": "git"
},
{
"lessThan": "ec369eac0795cfa8f4d3a0cd35a1e8e15f780331",
"status": "affected",
"version": "5477518b8a0e8a45239646acd80c9bafc4401522",
"versionType": "git"
},
{
"lessThan": "2c715f8a1e644ce4c3e8be5b0fd3f1f4704b73b3",
"status": "affected",
"version": "5477518b8a0e8a45239646acd80c9bafc4401522",
"versionType": "git"
},
{
"lessThan": "ca028334343a140efda4b22e53cbce2c5e94a489",
"status": "affected",
"version": "5477518b8a0e8a45239646acd80c9bafc4401522",
"versionType": "git"
},
{
"lessThan": "214af790e3a33ab73587de4c925c60a550eae9c6",
"status": "affected",
"version": "5477518b8a0e8a45239646acd80c9bafc4401522",
"versionType": "git"
},
{
"lessThan": "2e9261761b35f0b67b7487688cd1365f535be0b3",
"status": "affected",
"version": "5477518b8a0e8a45239646acd80c9bafc4401522",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/soc/qcom/qdsp6/q6apm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.16"
},
{
"lessThan": "5.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback\n\nWhen q6apm_free_fragments() is called it frees rx_data.buf/tx_data.buf\nand sets them to NULL under graph-\u003elock. A late DSP buffer-done response\ncan race with this: graph_callback() passes the !graph-\u003ear_graph guard\n(not yet NULL), acquires the lock, but then dereferences a now-NULL buf\npointer to read buf[token].phys, crashing at virtual address 0x10.\n\nAdd a NULL check for buf inside the mutex-protected section in both the\nwrite-done (DATA_CMD_RSP_WR_SH_MEM_EP_DATA_BUFFER_DONE_V2) and\nread-done (DATA_CMD_RSP_RD_SH_MEM_EP_DATA_BUFFER_V2) handlers and bail\nout cleanly if buffers have already been freed.\n\nThis problem is only shown up recently while apr bus was updated to\nprocess the commands per service rather from single global queue."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:11:15.758Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a164e744d8de1c41049bd9a1452a4b6bbf5bd8bc"
},
{
"url": "https://git.kernel.org/stable/c/ec369eac0795cfa8f4d3a0cd35a1e8e15f780331"
},
{
"url": "https://git.kernel.org/stable/c/2c715f8a1e644ce4c3e8be5b0fd3f1f4704b73b3"
},
{
"url": "https://git.kernel.org/stable/c/ca028334343a140efda4b22e53cbce2c5e94a489"
},
{
"url": "https://git.kernel.org/stable/c/214af790e3a33ab73587de4c925c60a550eae9c6"
},
{
"url": "https://git.kernel.org/stable/c/2e9261761b35f0b67b7487688cd1365f535be0b3"
}
],
"title": "ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72257",
"datePublished": "2026-08-15T05:54:44.448Z",
"dateReserved": "2026-08-09T03:40:39.915Z",
"dateUpdated": "2026-08-17T05:11:15.758Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…