CVE-2025-38307

In the Linux kernel, the following vulnerability has been resolved:

ASoC: Intel: avs: Verify content returned by parse_int_array()

The first element of the returned array stores its length. If it is 0, any manipulation beyond the element at index 0 ends with null-ptr-deref.

In the Intel ASoC avs debugfs interface, the trace_control_write() handler fails to validate the parsed input array from parse_int_array(). If the array length is 0, accessing array[1] results in a NULL pointer dereference, potentially leading to a kernel panic. This issue is limited to systems with debugfs enabled and accessible, typically requiring root privileges.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.