Security readout for executives and security teams
Plain-English summary
CVE-2025-22066 is a Linux kernel availability bug in the ASoC imx-card audio driver. If memory allocation fails during driver probing, missing error handling can cause a NULL pointer dereference and crash. The business impact is denial of service, not data theft or code execution based on the supplied sources.
Executive priority
Handle in normal kernel patch cycles, faster for multi-user or embedded Linux systems where local users can cause service disruption. It does not currently justify emergency response absent evidence of exploitation or broader impact.
Technical view
The flaw is CWE-476 in imx_card_probe(): devm_kasprintf() can return NULL, and the prior code did not check that result before later use. Kernel stable commits add a NULL check. CVSS 3.1 is 5.5, local attack vector, low complexity, low privileges, no confidentiality or integrity impact, high availability impact.
Likely exposure
Exposure is most relevant to Linux systems running affected kernel versions with the ASoC imx-card driver path present. This is likely narrower than all Linux deployments, but the supplied data does not provide distribution-specific affected package ranges beyond a Debian LTS advisory reference.
Exploitation context
The CVE is not listed as KEV, and the supplied sources do not state active exploitation. The CVSS vector indicates local, low-privilege exploitation with no user interaction. Treat it as a local denial-of-service risk until vendor advisories provide more context.
Researcher notes
Focus analysis on the imx-card probe path and allocation-failure handling. The source evidence supports denial of service from NULL dereference only. Do not assume remote reachability, privilege escalation, or exploit availability without additional vendor or threat-intelligence evidence.
Mitigation direction
- Update to a vendor kernel containing the referenced stable fix.
- Check Debian LTS or your distribution advisory for backported packages.
- Prioritize systems exposing local access to untrusted users.
- If patching is delayed, reduce untrusted local account access.
Validation and detection
- Inventory Linux kernel versions across affected fleets.
- Confirm whether the imx-card ASoC driver is built or loaded.
- Verify vendor packages include the NULL-check backport.
- Track remediation against the CVE and stable commit references.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-22066 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/018e6cf2503e60087747b0ebc190e18b3640766fCVE reference, Linux
- https://git.kernel.org/stable/c/38253922a89a742e7e622f626b41c64388367361CVE reference, Linux
- https://git.kernel.org/stable/c/e283a5bf4337a7300ac5e6ae363cc8b242a0b4b7CVE reference, Linux
- https://git.kernel.org/stable/c/4d8458e48ff135bddc402ad79821dc058ea163d0CVE reference, Linux
- https://git.kernel.org/stable/c/b01700e08be99e3842570142ec5973ccd7e73eafCVE reference, Linux
- https://git.kernel.org/stable/c/dd2bbb9564d0d24a2643ad90008a79840368c4b4CVE reference, Linux
- https://git.kernel.org/stable/c/93d34608fd162f725172e780b1c60cc93a920719CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
NULL Pointer Dereference
NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.