CVE-2026-72257

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A NULL pointer dereference exists in the graph callback() function. This occurs when q6apm free fragments() frees rx data.buf or tx data.buf and sets them to NULL under graph->lock. A race condition can occur where a late DSP buffer-done response passes the initial guard but dereferences the NULL buf pointer to read buf[token].phys, leading to a system crash. This issue is triggered during the processing of write-done (DATA CMD RSP WR SH MEM EP DATA BUFFER DONE V2) and read-done (DATA CMD RSP RD SH MEM EP DATA BUFFER V2) handlers.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.