{"affected":[{"defaultStatus":"unaffected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"lessThan":"cc03c899e6d9812b25c3754c9a95c3830c4aec26","status":"affected","version":"5a565ba23abe478f3d4c3b0c8798bcb5215b82f5","versionType":"git"},{"lessThan":"18ff538aac63de1866e5a49d57e22788b5c21d12","status":"affected","version":"5a565ba23abe478f3d4c3b0c8798bcb5215b82f5","versionType":"git"},{"lessThan":"2916794ffbce604cc2cda105f6b8a4a7c748dd7f","status":"affected","version":"5a565ba23abe478f3d4c3b0c8798bcb5215b82f5","versionType":"git"},{"lessThan":"93e246b6769bdacb09cfff4ea0f00fe5ab4f0d7a","status":"affected","version":"5a565ba23abe478f3d4c3b0c8798bcb5215b82f5","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"status":"affected","version":"6.2"},{"lessThan":"6.2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.94","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.34","versionType":"semver"},{"lessThanOrEqual":"6.15.*","status":"unaffected","version":"6.15.3","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.16","versionType":"original_commit_for_fix"}]}],"cveId":"CVE-2025-38307","cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: Intel: avs: Verify content returned by parse_int_array()\n\nThe first element of the returned array stores its length. If it is 0,\nany manipulation beyond the element at index 0 ends with null-ptr-deref.","epss":{"date":"2026-11-05","percentile":0.07116,"score":0.00176},"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793912551715,"publishedAt":1752133337427,"references":[{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/cc03c899e6d9812b25c3754c9a95c3830c4aec26"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/18ff538aac63de1866e5a49d57e22788b5c21d12"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/2916794ffbce604cc2cda105f6b8a4a7c748dd7f"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/93e246b6769bdacb09cfff4ea0f00fe5ab4f0d7a"}],"remediation":[],"revision":"08c54b6ed43301cac4030c16e2fa1cfc118e1e9fa57d4fae23ba03d962357d79","sources":[{"modifiedAt":1793912551715,"name":"CNA: Linux","retrievedAt":1793913647518,"url":"https://www.cve.org/CVERecord?id=CVE-2025-38307"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793913671657,"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-38307"}],"ssvc":{"assessedAt":1793912020625,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"ASoC: Intel: avs: Verify content returned by parse_int_array()","updatedAt":1793913671657}