CVE-2025-38105
Estado: ModificadaMedia (5.5)—
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: Kill timer properly at removal
The USB-audio MIDI code initializes the timer, but in a rare case, the driver might be freed without the disconnect call. This leaves the timer in an active state while the assigned object is released via snd_usbmidi_free(), which ends up with a kernel warning when the debug configuration is enabled, as spotted by fuzzer.
For avoiding the problem, put timer_shutdown_sync() at snd_usbmidi_free(), so that the timer can be killed properly. While we're at it, replace the existing timer_delete_sync() at the disconnect callback with timer_shutdown_sync(), too.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Puntuación base: 5.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.19%
- Percentil entre todas las CVEs puntuadas: 8
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- NVD-CWE-noinfo
Referencias
- https://git.kernel.org/stable/c/06513dd6d32c37d0364db8488cfdf3e14da238a8
- https://git.kernel.org/stable/c/0718a78f6a9f04b88d0dc9616cc216b31c5f3cf1
- https://git.kernel.org/stable/c/62066758d2ae169278e5d6aea5995b1b6f6ddeb5
- https://git.kernel.org/stable/c/647410a7da46067953a53c0d03f8680eff570959
- https://git.kernel.org/stable/c/c611b9e55174e439dcd85a72969b43a95f3827a4
- https://git.kernel.org/stable/c/efaf61052b8ff9ee8968912fbaf02c2847c78ede
JSON original (NVD)
Mostrar
{
"id": "CVE-2025-38105",
"cveTags": [],
"metrics": {
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 5.5,
"attackVector": "LOCAL",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "c88469704d63787e8d44ca5ea1c1bd0adc29572d",
"lessThan": "06513dd6d32c37d0364db8488cfdf3e14da238a8",
"versionType": "git"
},
{
"status": "affected",
"version": "c88469704d63787e8d44ca5ea1c1bd0adc29572d",
"lessThan": "efaf61052b8ff9ee8968912fbaf02c2847c78ede",
"versionType": "git"
},
{
"status": "affected",
"version": "c88469704d63787e8d44ca5ea1c1bd0adc29572d",
"lessThan": "647410a7da46067953a53c0d03f8680eff570959",
"versionType": "git"
},
{
"status": "affected",
"version": "c88469704d63787e8d44ca5ea1c1bd0adc29572d",
"lessThan": "c611b9e55174e439dcd85a72969b43a95f3827a4",
"versionType": "git"
},
{
"status": "affected",
"version": "c88469704d63787e8d44ca5ea1c1bd0adc29572d",
"lessThan": "62066758d2ae169278e5d6aea5995b1b6f6ddeb5",
"versionType": "git"
},
{
"status": "affected",
"version": "c88469704d63787e8d44ca5ea1c1bd0adc29572d",
"lessThan": "0718a78f6a9f04b88d0dc9616cc216b31c5f3cf1",
"versionType": "git"
}
],
"programFiles": [
"sound/usb/midi.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.14"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "2.6.14",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.111",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.52",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.15.3",
"versionType": "semver",
"lessThanOrEqual": "6.15.*"
},
{
"status": "unaffected",
"version": "6.16",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"sound/usb/midi.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2025-07-03T09:15:23.997",
"references": [
{
"url": "https://git.kernel.org/stable/c/06513dd6d32c37d0364db8488cfdf3e14da238a8",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/0718a78f6a9f04b88d0dc9616cc216b31c5f3cf1",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/62066758d2ae169278e5d6aea5995b1b6f6ddeb5",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/647410a7da46067953a53c0d03f8680eff570959",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c611b9e55174e439dcd85a72969b43a95f3827a4",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/efaf61052b8ff9ee8968912fbaf02c2847c78ede",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Kill timer properly at removal\n\nThe USB-audio MIDI code initializes the timer, but in a rare case, the\ndriver might be freed without the disconnect call. This leaves the\ntimer in an active state while the assigned object is released via\nsnd_usbmidi_free(), which ends up with a kernel warning when the debug\nconfiguration is enabled, as spotted by fuzzer.\n\nFor avoiding the problem, put timer_shutdown_sync() at\nsnd_usbmidi_free(), so that the timer can be killed properly.\nWhile we're at it, replace the existing timer_delete_sync() at the\ndisconnect callback with timer_shutdown_sync(), too."
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ALSA: usb-audio: Kill timer properly at removal El código MIDI USB-audio inicializa el temporizador, pero en un caso raro, el controlador podría liberarse sin la llamada de desconexión. Esto deja al temporizador en un estado activo mientras el objeto asignado se libera a través de snd_usbmidi_free(), lo que termina con una advertencia del kernel cuando se habilita la configuración de depuración, como lo detectó un fuzzer. Para evitar el problema, coloque timer_shutdown_sync() en snd_usbmidi_free(), para que el temporizador pueda ser eliminado correctamente. Mientras estamos en ello, reemplace también el timer_delete_sync() existente en la devolución de llamada de desconexión con timer_shutdown_sync()."
}
],
"lastModified": "2026-06-17T09:16:03.890",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0317582A-6B0D-428B-AEE4-F2F23E337ACF",
"versionEndExcluding": "6.6.111",
"versionStartIncluding": "2.6.14"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2D9B210A-8880-498F-A5CE-0C653F909220",
"versionEndExcluding": "6.12.52",
"versionStartIncluding": "6.7"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0541C761-BD5E-4C1A-8432-83B375D7EB92",
"versionEndExcluding": "6.15.3",
"versionStartIncluding": "6.13"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}