Executive brief
A vulnerability was identified in the Linux kernel's USB audio driver that could lead to a system crash or unpredictable behavior. The issue occurs when a USB MIDI device is disconnected, potentially allowing the system to access memory that has already been freed. This could be exploited by a local user to cause a denial of service or potentially gain unauthorized access to system information.
Technical details
A use-after-free (UAF) vulnerability exists in the snd_usbmidi_free function within the ALSA usb-audio driver (sound/usb/midi.c). The root cause is a race condition where the error timer and USB Request Blocks (URBs) are not properly synchronized or killed before heap memory is freed. Specifically, if an error timer or URB interrupt occurs after the endpoint is deleted but before the memory is fully cleared, the kernel attempts to access freed memory. This was a regression or incomplete fix for a previous UAF issue. The fix involves ensuring snd_usbmidi_disconnect is called and that timers/URBs are shut down before memory deallocation. Patch availability is confirmed across multiple stable kernel branches.
Affected products
- Linux Linux Kernel ALSA usb-audio component
Timeline
- 2025-09-28: patched: Initial fix committed to mainline kernel
- 2025-10-15: disclosed: CVE-2025-39997 published
References
- https://git.kernel.org/stable/c/353d8c715cc951a980728133c9dd64ca5a0a186c
- https://git.kernel.org/stable/c/647d6b8d22be12842fde6ed0c56859ebc615f21e
- https://git.kernel.org/stable/c/9f2c0ac1423d5f267e7f1d1940780fc764b0fee3
- https://git.kernel.org/stable/c/af600e7f5526d16146b3ae99f6ad57bfea79ca33
- https://git.kernel.org/stable/c/dc4874366cf6cf4a31d8fa4b7f0e2a5b2d7647ba
- https://git.kernel.org/stable/c/e16985513e89466a236d2a7c202783b4dd0c5a46
- https://git.kernel.org/stable/c/e63f049c7764b615d1d50cb486745fa63372b42d