CVE-2025-38130: 
Linux Kernel vulnerability analysis and mitigation

In the Linux kernel, a vulnerability was discovered related to the HDMI audio helper callback functionality. The issue occurs when the sound/soc/codecs/hdmi-codec.c calls the plugged_cb with NULL as the callback function and codec_dev during driver removal. This vulnerability was assigned CVE-2025-38130 and was disclosed on July 3, 2025 (NVD).

The vulnerability stems from the HDMI audio helper attempting to execute a null function pointer during driver removal. Specifically, when the hdmi_remove function is called, it passes NULL as the callback function along with codec_dev. The HDMI audio helper then attempts to call this null function pointer, resulting in a kernel Oops (CVE).

When exploited, this vulnerability causes a kernel Oops, which can lead to system instability or denial of service conditions. The issue affects the Linux kernel's DRM connector subsystem, specifically impacting HDMI audio functionality (Ubuntu).

The issue has been fixed by implementing a check to only execute the callback if the function pointer (fn) is non-null. This ensures that the .plugged_cb and .plugged_cb_dev members are still appropriately cleared without attempting to execute a null function pointer (NVD).