A race condition exists in the Qualcomm ASoC q6apm driver for the Linux kernel. When the driver frees DSP buffer pointers during q6apm_free_fragments(), a pending DSP buffer-done response can arrive and the graph_callback function may read from a now-NULL buf pointer under the protection of a lock. This leads to a NULL pointer dereference and a kernel oops at virtual address 0x10, causing a system crash. The weakness corresponds to CWE-476 (NULL Pointer Dereference).

All Linux kernel releases that include the Qualcomm ASoC q6apm driver, without a later patch that adds NULL checks in the buffer-done handlers, are vulnerable. No specific kernel version range is listed, so any kernel incorporating the affected driver before the recent commit should be considered at risk.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score is reported as <1%, implying a low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Likely attack vector is local: an attacker with access to the DSP or audio subsystem could trigger DSP buffer-done events. This could be achieved through local firmware or audio interfaces that interact with the q6apm driver, potentially causing a denial of service on the affected system.