Junglewise Threat Intelligence

CVE-2025-38105: Linux Kernel ALSA use-after-free in USB-audio MIDI timer

CVE-2025-38105 · Severity: medium · CVSS 5.5 · Published 2025-07-03

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's USB-audio driver could allow a local user to cause a system crash or instability. The issue occurs when certain MIDI audio devices are removed from the system, leaving background tasks running after their associated memory has been deleted. This can lead to kernel warnings or system failures, impacting the availability of the affected machine.

Technical details

A race condition and use-after-free vulnerability exists in the ALSA USB-audio MIDI implementation (sound/usb/midi.c) of the Linux kernel. The driver initializes a timer for error handling, but in specific edge cases, the driver object may be freed via snd_usbmidi_free() without the disconnect callback being triggered. This leaves the 'error_timer' in an active state while its parent object is deallocated. A local attacker or a fuzzer can trigger this state to cause a kernel panic or denial of service. The fix involves implementing timer_shutdown_sync() in the snd_usbmidi_free() function to ensure the timer is properly terminated before memory is reclaimed.

Affected products

  • Linux Linux Kernel 2.6.14 to 6.6.111, 6.7 to 6.12.52, 6.13 to 6.15.3

Timeline

  • 2025-07-03: disclosed: Initial publication of the CVE record.
  • 2025-05-19: patched: Initial patch authored by Takashi Iwai.

References