IM
IronMonkey Threat Research

CVE-2025-38105 MEDIUM

Published: 2025-07-03 | Last Modified: 2026-06-01 | Status: Modified

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Kill timer properly at removal The USB-audio MIDI code initializes the timer, but in a rare case, the driver might be freed without the disconnect call. This leaves the timer in an active state while the assigned object is released via snd_usbmidi_free(), which ends up with a kernel warning when the debug configuration is enabled, as spotted by fuzzer. For avoiding the problem, put timer_shutdown_sync() at snd_usbmidi_free(), so that the timer can be killed properly. While we're at it, replace the existing timer_delete_sync() at the disconnect callback with timer_shutdown_sync(), too.

Additional Descriptions (1)

En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ALSA: usb-audio: Kill timer properly at removal El código MIDI USB-audio inicializa el temporizador, pero en un caso raro, el controlador podría liberarse sin la llamada de desconexión. Esto deja al temporizador en un estado activo mientras el objeto asignado se libera a través de snd_usbmidi_free(), lo que termina con una advertencia del kernel cuando se habilita la configuración de depuración, como lo detectó un fuzzer. Para evitar el problema, coloque timer_shutdown_sync() en snd_usbmidi_free(), para que el temporizador pueda ser eliminado correctamente. Mientras estamos en ello, reemplace también el timer_delete_sync() existente en la devolución de llamada de desconexión con timer_shutdown_sync().

CVSS Metrics

Base Score: 5.5 (MEDIUM)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack VectorLOCAL
Attack ComplexityLOW
Privileges RequiredLOW
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactNONE
Integrity ImpactNONE
Availability ImpactHIGH

Source: [email protected]

Type: Primary

Exploitability Score: 1.8

Impact Score: 3.6

Weaknesses

Source Type Description
[email protected] Primary
en NVD-CWE-noinfo

Affected Products

Vendor Product Version Update Type
linux linux_kernel * <built-in method update of dict object at 0x7fd2d39ff300> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd2d39ff5c0> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd290111680> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

References