Skip to main content

Linux Kernel CVE-2026-43412

| EUVDEUVD-2026-28718 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-05-08 Linux GHSA-prhc-6f6q-3vrj
Denial Of Service Linux Null Pointer Dereference Red Hat Qualcomm Suse
5.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain local shell with low privileges
  2. Delivery
    Load or confirm q6apm audio modules are active
  3. Exploit
    Trigger ADSP PDR restart via pdr_interface
  4. Execution
    q6apm .remove deletes RTDs before DAI unbind
  5. Persist
    Rebind dereferences NULL DAPM context pointer
  6. Impact
    Kernel oops causes denial of service

Vulnerability Assessment

Weakness
CWE
CWE-476
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires: (1) local authenticated access with at minimum low privileges (CVSS PR:L), ruling out unauthenticated remote exploitation; (2) the target system must use Qualcomm QDSP6 audio hardware with the q6apm, q6apm_dai, and q6apm_lpass_dais kernel modules loaded - this is non-default on general-purpose Linux distributions and specific to Qualcomm SoC platforms; (3) the ADSP must undergo a stop-and-start cycle (PDR restart), which can be triggered by ADSP firmware failure, power management events, or deliberate invocation of the pdr_interface subsystem. Limiting factors: the vulnerability is hardware-specific (Qualcomm QDSP6 only), requires the audio subsystem to be active with QDSP6 DAI components registered, and requires a PDR restart event - normal steady-state system operation without an ADSP restart cycle is not affected.
Impact

CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) correctly classifies this as a local, low-complexity, low-privilege denial-of-service. The attack vector is local, meaning exploitation requires either physical access or a local session on the target; there is no network-reachable path. EPSS at 0.02% (7th percentile) corroborates a very low probability of opportunistic exploitation. The vulnerability is not listed in CISA KEV, and no POC code has been identified. Real-world risk is further constrained by hardware specificity: only systems carrying Qualcomm QDSP6 audio hardware (SA8775P, SC8280XP, and similar) are affected, which primarily covers automotive infotainment and high-end embedded platforms rather than commodity servers or desktops. The primary threat model is an inadvertent kernel panic during normal ADSP restart operations (e.g., firmware crash recovery) or a local attacker with shell access deliberately triggering a PDR restart cycle to deny audio service. No confidentiality or integrity impact exists. Patched stable releases are available across all supported kernel branches, making this a straightforward maintenance update rather than an emergency response.
Exploit ScenarioDerived

A local user with a shell session (PR:L) on a Qualcomm SA8775P or SC8280XP embedded system deliberately triggers repeated ADSP protection-domain restart cycles - for example by forcibly crashing the ADSP firmware or calling into the PDR interface - causing the q6apm .remove callback to execute out of order and leaving dangling DAI component pointers. On the next ASoC rebind, soc_dapm_shutdown_dapm dereferences a NULL DAPM context pointer, producing a kernel oops and system crash, denying audio service and potentially causing a full system restart. No public POC exists; the scenario is grounded in the crash trace and PDR workqueue involvement shown in the kernel log.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 21, 2026

NULL pointer dereference in the Linux kernel's ASoC QCOM QDSP6 subsystem crashes systems built on Qualcomm SA8775P and SC8280XP SoCs during ADSP protection-domain restart cycles. The crash occurs because the q6apm-audio .remove callback prematurely deletes Runtime Descriptions (RTDs) containing q6apm DAI components during ASoC teardown, leaving those components still linked to the sound card and triggering a kernel oops on the subsequent rebind. Impact is limited to availability (kernel panic/denial of service); no public exploit has been identified at time of analysis, and EPSS at 0.02% reflects very low widespread exploitation probability.

RemediationAI

The primary remediation is upgrading to a fixed kernel version: 6.1.167, 6.6.130, 6.12.78, 6.18.19, 6.19.9, or 7.0. Fix commits are available at the following upstream stable trees: https://git.kernel.org/stable/c/897f32cab7945f4662a50b3841ba31c6c3204876 (6.1.x), https://git.kernel.org/stable/c/d6db827b430bdcca3976cebca7bd69cca03cde2c (6.6.x), https://git.kernel.org/stable/c/94bda21adb2a51f69366b847b4d80dfe50bd9fb9 (6.12.x), https://git.kernel.org/stable/c/a8e9cab16771b15160465783507496dc83742d8e (6.18.x), https://git.kernel.org/stable/c/22b05abb17e3c6ef45035141fe3d26f815ff9d30 (6.19.x), and https://git.kernel.org/stable/c/0da170b9e600da6930cfb8352e4cc036db3b6159 (mainline). If an immediate kernel upgrade is not feasible, a compensating control is to prevent ADSP PDR restart cycles by disabling the pdr_interface or qcom_pd_mapper kernel modules (rmmod pdr_interface qcom_pd_mapper) - this prevents the triggering condition but will also disable Qualcomm protection-domain restart recovery, meaning ADSP firmware crashes will not self-recover. Alternatively, restricting the sound subsystem (modprobe -r snd_q6apm q6apm_dai) eliminates the vulnerable code path but disables Qualcomm QDSP6 audio entirely.

Affected VersionsENISA

Linux patch: 0
Linux 5477518b8a0e8a45239646acd80c9bafc4401522 <22b05abb17e3c6ef45035141fe3d26f815ff9d30
Linux patch: 6.19.9
Linux 5.16
Linux 5477518b8a0e8a45239646acd80c9bafc4401522 <a8e9cab16771b15160465783507496dc83742d8e
Linux patch: 6.18.19
Linux patch: 6.6.130
Linux patch: 6.1.167
Linux 5477518b8a0e8a45239646acd80c9bafc4401522 <897f32cab7945f4662a50b3841ba31c6c3204876
Linux patch: 6.12.78
Linux 5477518b8a0e8a45239646acd80c9bafc4401522 <94bda21adb2a51f69366b847b4d80dfe50bd9fb9
Linux 5477518b8a0e8a45239646acd80c9bafc4401522 <d6db827b430bdcca3976cebca7bd69cca03cde2c
Linux patch: 7.0
Linux 5477518b8a0e8a45239646acd80c9bafc4401522 <0da170b9e600da6930cfb8352e4cc036db3b6159

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability resides in the ALSA System-on-Chip (ASoC) framework's Qualcomm QDSP6 Audio Processing Manager (q6apm) driver, introduced at upstream commit 5477518b8a0e8a45239646acd80c9bafc4401522, which first appeared in Linux 5.16. The ADSP runs under Qualcomm's Protection Domain Restart (PDR) mechanism; when the ADSP stops and restarts, the kernel invokes .remove callbacks across all registered ASoC components. The q6apm component's callback calls snd_soc_unregister_component, which tears down PCM runtimes and deletes RTDs before dependent q6apm DAI components are unbound. On the next rebind, soc_dapm_shutdown_dapm attempts to acquire a mutex (mutex_lock+0xc) via a now-freed or NULL DAPM context pointer at virtual address 0x00000000000000d0, producing a level-0 translation fault (DABT, ESR=0x96000004). CWE-476 (NULL Pointer Dereference) accurately characterizes the root cause: a use-after-free/null-dereference arising from incorrect component teardown ordering rather than memory corruption or code injection.

Know when Qualcomm gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SUSE MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

3
CVSS changed
May 21, 2026 - 18:22 NVD
5.5 (MEDIUM)
Patch available
May 08, 2026 - 16:18 EUVD
CVE Published
May 08, 2026 - 14:21 nvd
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and start

During ADSP stop and start, the kernel crashes due to the order in which ASoC components are removed.

On ADSP stop, the q6apm-audio .remove callback unloads topology and removes PCM runtimes during ASoC teardown. This deletes the RTDs that contain the q6apm DAI components before their removal pass runs, leaving those components still linked to the card and causing crashes on the next rebind.

Fix this by ensuring that all dependent (child) components are removed first, and the q6apm component is removed last.

[ 48.105720] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000d0 [ 48.114763] Mem abort info: [ 48.117650] ESR = 0x0000000096000004 [ 48.121526] EC = 0x25: DABT (current EL), IL = 32 bits [ 48.127010] SET = 0, FnV = 0 [ 48.130172] EA = 0, S1PTW = 0 [ 48.133415] FSC = 0x04: level 0 translation fault [ 48.138446] Data abort info: [ 48.141422] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 [ 48.147079] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 48.152354] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 48.157859] user pgtable: 4k pages, 48-bit VAs, pgdp=00000001173cf000 [ 48.164517] [00000000000000d0] pgd=0000000000000000, p4d=0000000000000000 [ 48.171530] Internal error: Oops: 0000000096000004 [#1] SMP [ 48.177348] Modules linked in: q6prm_clocks q6apm_lpass_dais q6apm_dai snd_q6dsp_common q6prm snd_q6apm 8021q garp mrp stp llc snd_soc_hdmi_codec apr pdr_interface phy_qcom_edp fastrpc qcom_pd_mapper rpmsg_ctrl qrtr_smd rpmsg_char qcom_pdr_msg qcom_iris v4l2_mem2mem videobuf2_dma_contig ath11k_pci msm ubwc_config at24 ath11k videobuf2_memops mac80211 ocmem videobuf2_v4l2 libarc4 drm_gpuvm mhi qrtr videodev drm_exec snd_soc_sc8280xp gpu_sched videobuf2_common nvmem_qcom_spmi_sdam snd_soc_qcom_sdw drm_dp_aux_bus qcom_q6v5_pas qcom_spmi_temp_alarm snd_soc_qcom_common rtc_pm8xxx qcom_pon drm_display_helper cec qcom_pil_info qcom_stats soundwire_bus drm_client_lib mc dispcc0_sa8775p videocc_sa8775p qcom_q6v5 camcc_sa8775p snd_soc_dmic phy_qcom_sgmii_eth snd_soc_max98357a i2c_qcom_geni snd_soc_core dwmac_qcom_ethqos llcc_qcom icc_bwmon qcom_sysmon snd_compress qcom_refgen_regulator coresight_stm stmmac_platform snd_pcm_dmaengine qcom_common coresight_tmc stmmac coresight_replicator qcom_glink_smem coresight_cti stm_core [ 48.177444] coresight_funnel snd_pcm ufs_qcom phy_qcom_qmp_usb gpi phy_qcom_snps_femto_v2 coresight phy_qcom_qmp_ufs qcom_wdt gpucc_sa8775p pcs_xpcs mdt_loader qcom_ice icc_osm_l3 qmi_helpers snd_timer snd soundcore display_connector qcom_rng nvmem_reboot_mode drm_kms_helper phy_qcom_qmp_pcie sha256 cfg80211 rfkill socinfo fuse drm backlight ipv6 [ 48.301059] CPU: 2 UID: 0 PID: 293 Comm: kworker/u32:2 Not tainted 6.19.0-rc6-dirty #10 PREEMPT [ 48.310081] Hardware name: Qualcomm Technologies, Inc. Lemans EVK (DT) [ 48.316782] Workqueue: pdr_notifier_wq pdr_notifier_work [pdr_interface] [ 48.323672] pstate: 20400005 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 48.330825] pc : mutex_lock+0xc/0x54 [ 48.334514] lr : soc_dapm_shutdown_dapm+0x44/0x174 [snd_soc_core] [ 48.340794] sp : ffff800084ddb7b0 [ 48.344207] x29: ffff800084ddb7b0 x28: ffff00009cd9cf30 x27: ffff00009cd9cc00 [ 48.351544] x26: ffff000099610190 x25: ffffa31d2f19c810 x24: ffffa31d2f185098 [ 48.358869] x23: ffff800084ddb7f8 x22: 0000000000000000 x21: 00000000000000d0 [ 48.366198] x20: ffff00009ba6c338 x19: ffff00009ba6c338 x18: 00000000ffffffff [ 48.373528] x17: 000000040044ffff x16: ffffa31d4ae6dca8 x15: 072007740775076f [ 48.380853] x14: 0765076d07690774 x13: 00313a323a656369 x12: 767265733a637673 [ 48.388182] x11: 00000000000003f9 x10: ffffa31d4c7dea98 x9 : 0000000000000001 [ 48.395519] x8 : ffff00009a2aadc0 x7 : 0000000000000003 x6 : 0000000000000000 [ 48.402854] x5 : 0000000000000 ---truncated---

Threat Intelligence Overview

EPSS Score
0.0%
Top 93% exploitable
Data Quality
4 sources
Confidence: Medium
EUVD NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Null Pointer Dereference MEDIUM

A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Qualcomm

View all
CVE-2013-2597 HIGH
8.4 Aug 31

Stack-based buffer overflow in the acdb_ioctl function in audio_acdb.c in the acdb audio driver for the Linux kernel 2.6
CVE-2014-10031 HIGH POC
7.5 Jan 13

Buffer overflow in the IMAPd service in Qualcomm Eudora WorldMail 9.0.333.0 allows remote attackers to execute arbitrary
CVE-2025-21480 HIGH
8.6 Jun 03

Qualcomm GPU micronode contains a memory corruption vulnerability (CVE-2025-21480, CVSS 8.6) caused by unauthorized comm
CVE-2025-21479 HIGH
8.6 Jun 03

A second Qualcomm GPU micronode memory corruption vulnerability (CVE-2025-21479, CVSS 8.6) exists in the unauthorized co
CVE-2026-21385 HIGH POC
7.8 Mar 02

A Qualcomm chipset vulnerability (CVE-2026-21385) causes memory corruption through improper integer handling during memo
CVE-2025-27038 HIGH
7.5 Jun 03

Qualcomm Adreno GPU drivers in Chrome contain a use-after-free vulnerability (CVE-2025-27038, CVSS 7.5) enabling memory

CVE-2020-11117 CRITICAL POC
9.8 Sep 08

u'In the lbd service, an external user can issue a specially crafted debug command to overwrite arbitrary files with arb
CVE-2016-5348 MEDIUM POC
5.9 Oct 10

The GPS component in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 be
CVE-2014-4322 HIGH POC
7.2 Dec 24

drivers/misc/qseecom.c in the QSEECOM driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Andr
CVE-2015-0569 HIGH POC
7.8 May 09

Heap-based buffer overflow in the private wireless extensions IOCTL implementation in wlan_hdd_wext.c in the WLAN (aka W
CVE-2017-8260 HIGH POC
7.8 Aug 18

In all Qualcomm products with Android releases from CAF using the Linux kernel, due to a type downcast, a value may impr
CVE-2016-3934 HIGH POC
7.8 Oct 10

drivers/media/platform/msm/camera_v2/sensor/io/msm_camera_cci_i2c.c in the Qualcomm camera driver in Android before 2016

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2020-1967 HIGH POC
7.5
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2021-3449 MEDIUM
5.9
CVE-2015-3194 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-43412 ADVISORY https://ubuntu.com/security/notices/USN-8567-1 ADVISORY https://vuldb.com/vuln/362202 REF https://git.kernel.org/stable/c/0da170b9e600da6930cfb8352e4cc036db3b6159 REF https://git.kernel.org/stable/c/22b05abb17e3c6ef45035141fe3d26f815ff9d30 REF https://git.kernel.org/stable/c/897f32cab7945f4662a50b3841ba31c6c3204876 REF https://git.kernel.org/stable/c/94bda21adb2a51f69366b847b4d80dfe50bd9fb9 REF https://git.kernel.org/stable/c/a8e9cab16771b15160465783507496dc83742d8e REF https://git.kernel.org/stable/c/d6db827b430bdcca3976cebca7bd69cca03cde2c

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy