Skip to main content

Linux Kernel CVE-2026-43137

| EUVDEUVD-2026-27699 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-05-06 Linux GHSA-f9xw-88w2-23h7
Denial Of Service Linux Null Pointer Dereference Intel
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.7 MEDIUM

Topology mismatch is a required precondition not under attacker control, warranting AC:H; PR:L and AV:L confirmed by description; impact is availability-only via kernel panic.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 24, 2026 - 01:09 vuln.today
CVSS changed
May 12, 2026 - 21:22 NVD
5.5 (MEDIUM)
Patch available
May 06, 2026 - 13:32 EUVD
CVE Published
May 06, 2026 - 11:27 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ASoC: SOF: Intel: hda: Fix NULL pointer dereference

If there's a mismatch between the DAI links in the machine driver and the topology, it is possible that the playback/capture widget is not set, especially in the case of loopback capture for echo reference where we use the dummy DAI link. Return the error when the widget is not set to avoid a null pointer dereference like below when the topology is broken.

RIP: 0010:hda_dai_get_ops.isra.0+0x14/0xa0 [snd_sof_intel_hda_common]

AnalysisAI

NULL pointer dereference in the Linux kernel's ASoC SOF Intel HDA audio subsystem crashes the kernel when DAI link topology mismatches occur. The function hda_dai_get_ops in the snd_sof_intel_hda_common module dereferences an uninitialized widget pointer - particularly during loopback capture echo reference operations using dummy DAI links with a broken topology. A local low-privileged user on an affected Intel SOF HDA system can trigger a kernel panic, causing a denial of service. No active exploitation has been identified (EPSS 0.02%, 5th percentile, no CISA KEV listing), and patches are available in multiple stable kernel branches.

Technical ContextAI

This vulnerability resides in the ASoC (Advanced Linux Sound Architecture SoC) subsystem's SOF (Sound Open Firmware) driver for Intel HDA (High Definition Audio) hardware, packaged in the snd_sof_intel_hda_common kernel module. The crash site identified in the commit is hda_dai_get_ops.isra.0+0x14/0xa0, where a DAI (Digital Audio Interface) widget pointer is accessed without a NULL guard. The mismatch arises when the machine driver's DAI link definitions diverge from the loaded audio topology - a condition that can occur particularly during echo-reference loopback capture, which relies on dummy DAI links. CWE-476 (NULL Pointer Dereference) describes the root cause: a code path that assumes a pointer is valid without verifying it. The fix adds an explicit error return before the dereference when the widget is unset. CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* covers all affected kernel versions up to the stable-branch fix commits.

RemediationAI

The primary fix is to update the Linux kernel to a patched stable release: 6.12.75, 6.18.16, 6.19.6, or 7.0, corresponding to upstream stable commits at https://git.kernel.org/stable/c/10411f1f2c76be67103b1f95822ff629aa25e2aa (6.19.x), https://git.kernel.org/stable/c/42068f7dd42b559c4eeae645e1455ff36518866a (6.12.x), https://git.kernel.org/stable/c/7750d78b4014902bc0ac03d4bb30faa076a913ab (6.18.x), and https://git.kernel.org/stable/c/16c589567a956d46a7c1363af3f64de3d420af20 (7.0). Ubuntu users should apply USN-8492-1 via standard package update channels. As a compensating control where patching is not immediately possible, blacklisting the snd_sof_intel_hda_common module (via /etc/modprobe.d) prevents the vulnerable code path from executing but will disable Intel SOF-based HDA audio entirely - acceptable only on systems where audio is non-essential. Ensuring audio topology files are valid and consistent with the machine driver's DAI link definitions also eliminates the triggering condition without impacting functionality.

More in Intel

View all
CVE-2021-44228 CRITICAL POC
10.0 Dec 10

Apache Log4j2 contains a critical JNDI injection vulnerability known as 'Log4Shell' that allows unauthenticated remote c
CVE-2017-5689 CRITICAL POC
9.8 May 02

An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Mana
CVE-2012-5958 CRITICAL POC
10.0 Jan 31

Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable
CVE-2012-0217 HIGH POC
7.2 Jun 12

The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and

CVE-2012-5959 CRITICAL POC
10.0 Jan 31

Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable
CVE-2012-5964 CRITICAL POC
10.0 Jan 31

Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable
CVE-2012-5963 CRITICAL POC
10.0 Jan 31

Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable
CVE-2012-5961 CRITICAL POC
10.0 Jan 31

Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable
CVE-2017-5753 MEDIUM POC
5.6 Jan 04

Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of

CVE-2012-5965 CRITICAL POC
10.0 Jan 31

Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable
CVE-2012-5962 CRITICAL POC
10.0 Jan 31

Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable
CVE-2012-5960 CRITICAL POC
10.0 Jan 31

Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-43137 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy