{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2026-72257",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-72257",
    "idYear": 2026,
    "status": "PUBLISHED",
    "publishedAt": "2026-08-15T05:54:44.448Z",
    "updatedAt": "2026-08-17T05:11:15.758Z",
    "importedAt": "2026-10-24T01:58:25.636Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback",
      "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback\n\nWhen q6apm_free_fragments() is called it frees rx_data.buf/tx_data.buf\nand sets them to NULL under graph->lock. A late DSP buffer-done response\ncan race with this: graph_callback() passes the !graph->ar_graph guard\n(not yet NULL), acquires the lock, but then dereferences a now-NULL buf\npointer to read buf[token].phys, crashing at virtual address 0x10.\n\nAdd a NULL check for buf inside the mutex-protected section in both the\nwrite-done (DATA_CMD_RSP_WR_SH_MEM_EP_DATA_BUFFER_DONE_V2) and\nread-done (DATA_CMD_RSP_RD_SH_MEM_EP_DATA_BUFFER_V2) handlers and bail\nout cleanly if buffers have already been freed.\n\nThis problem is only shown up recently while apr bus was updated to\nprocess the commands per service rather from single global queue.",
      "affected": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "5477518b8a0e8a45239646acd80c9bafc4401522",
              "status": "affected",
              "versionType": "git",
              "lessThan": "a164e744d8de1c41049bd9a1452a4b6bbf5bd8bc"
            },
            {
              "version": "5477518b8a0e8a45239646acd80c9bafc4401522",
              "status": "affected",
              "versionType": "git",
              "lessThan": "ec369eac0795cfa8f4d3a0cd35a1e8e15f780331"
            },
            {
              "version": "5477518b8a0e8a45239646acd80c9bafc4401522",
              "status": "affected",
              "versionType": "git",
              "lessThan": "2c715f8a1e644ce4c3e8be5b0fd3f1f4704b73b3"
            },
            {
              "version": "5477518b8a0e8a45239646acd80c9bafc4401522",
              "status": "affected",
              "versionType": "git",
              "lessThan": "ca028334343a140efda4b22e53cbce2c5e94a489"
            },
            {
              "version": "5477518b8a0e8a45239646acd80c9bafc4401522",
              "status": "affected",
              "versionType": "git",
              "lessThan": "214af790e3a33ab73587de4c925c60a550eae9c6"
            },
            {
              "version": "5477518b8a0e8a45239646acd80c9bafc4401522",
              "status": "affected",
              "versionType": "git",
              "lessThan": "2e9261761b35f0b67b7487688cd1365f535be0b3"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "5.16",
              "status": "affected"
            },
            {
              "version": "0",
              "status": "unaffected",
              "versionType": "semver",
              "lessThan": "5.16"
            },
            {
              "version": "6.1.178",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "version": "6.6.145",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "version": "6.12.97",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "version": "6.18.40",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "version": "7.1.5",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "version": "7.2",
              "status": "unaffected",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ]
        }
      ]
    }
  }
}