Not yet scoredPublished Oct 20, 2025

CVE-2025-40013ASoC: qcom: audioreach: fix potential null pointer dereference

Updated under an hour ago (Oct 28, 2026, 6:40 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: audioreach: fix potential null pointer dereference It is possible that the topology parsing function audioreach_widget_load_module_common() could return NULL or an error pointer. Add missing NULL check so that we do not dereference it.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Deferred
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	36ad9bf1d93d66b901342eab9f8ed6c1537655a6 builds before 9c1ad4192f3d2fc85339718a6252cb3337848f7b; from 36ad9bf1d93d66b901342eab9f8ed6c1537655a6 before 70e1e5fe9f7e05ff831b56ebc02543e7811b8e18; 36ad9bf1d93d66b901342eab9f8ed6c1537655a6 builds before 4dda55d04caac3b4102c26e29b1c27fa35636be3; 36ad9bf1d93d66b901342eab9f8ed6c1537655a6 builds before 8f9c9fafc0e7a73bbff58954d171c016ddee1734; from 36ad9bf1d93d66b901342eab9f8ed6c1537655a6 before ef08ce6304d30b5778035d07b04514cb70839983; from 36ad9bf1d93d66b901342eab9f8ed6c1537655a6 before 8318e04ab2526b155773313b66a1542476ce1106	CNA record

References

References

https://git.kernel.org/stable/c/9c1ad4192f3d2fc85339718a6252cb3337848f7b
https://git.kernel.org/stable/c/70e1e5fe9f7e05ff831b56ebc02543e7811b8e18
https://git.kernel.org/stable/c/4dda55d04caac3b4102c26e29b1c27fa35636be3
https://git.kernel.org/stable/c/8f9c9fafc0e7a73bbff58954d171c016ddee1734
https://git.kernel.org/stable/c/ef08ce6304d30b5778035d07b04514cb70839983
https://git.kernel.org/stable/c/8318e04ab2526b155773313b66a1542476ce1106

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.