In the sound subsystem of the Linux kernel, a null pointer dereference exists in the SDCA device unregistration path when the code iterates over function descriptors without validating pointers. If a registration partially fails or probe deferral races cleanup, entries may be NULL, causing a kernel oops This weakness is a classic null pointer dereference (CWE‑476) and can trigger denial of service.

All Linux kernel distributions that ship the ASoC SDCA driver before the patch are affected. The vulnerable code resides in the soundwire bus and the Linux kernel’s sound subsystem, so any system that loads the SDCA module and may experience probe failures or races—such as devices using SoundWire audio buses—is at risk. The CVE was observed on a Lenovo ThinkPad X1 Carbon G14 using Panther Lake firmware, but the flaw applies broadly to any kernel with the affected driver.

The CVSS score of 5.5 indicates medium severity, and the EPSS score of < 1% together with the absence from the CISA KEV catalogue suggest a low probability of exploitation today. The likely attack vector, inferred from the description, involves provoking a probe failure or race condition that results in a NULL cleanup, though the text does not specify required privileges or exact scope.