« Volver al listado

CVE-2025-39997

Estado: AplazadaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free

The previous commit 0718a78f6a9f ("ALSA: usb-audio: Kill timer properly at removal") patched a UAF issue caused by the error timer.

However, because the error timer kill added in this patch occurs after the endpoint delete, a race condition to UAF still occurs, albeit rarely.

Additionally, since kill-cleanup for urb is also missing, freed memory can be accessed in interrupt context related to urb, which can cause UAF.

Therefore, to prevent this, error timer and urb must be killed before freeing the heap memory.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-39997",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "06513dd6d32c37d0364db8488cfdf3e14da238a8",
              "lessThan": "e63f049c7764b615d1d50cb486745fa63372b42d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "efaf61052b8ff9ee8968912fbaf02c2847c78ede",
              "lessThan": "e16985513e89466a236d2a7c202783b4dd0c5a46",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "647410a7da46067953a53c0d03f8680eff570959",
              "lessThan": "dc4874366cf6cf4a31d8fa4b7f0e2a5b2d7647ba",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c611b9e55174e439dcd85a72969b43a95f3827a4",
              "lessThan": "647d6b8d22be12842fde6ed0c56859ebc615f21e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0718a78f6a9f04b88d0dc9616cc216b31c5f3cf1",
              "lessThan": "af600e7f5526d16146b3ae99f6ad57bfea79ca33",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0718a78f6a9f04b88d0dc9616cc216b31c5f3cf1",
              "lessThan": "353d8c715cc951a980728133c9dd64ca5a0a186c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0718a78f6a9f04b88d0dc9616cc216b31c5f3cf1",
              "lessThan": "9f2c0ac1423d5f267e7f1d1940780fc764b0fee3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "62066758d2ae169278e5d6aea5995b1b6f6ddeb5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6.1.167",
              "lessThan": "6.1.175",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "6.15.3",
              "lessThan": "6.16",
              "versionType": "semver"
            }
          ],
          "programFiles": [
            "sound/usb/midi.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.16",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.16.11",
              "versionType": "semver",
              "lessThanOrEqual": "6.16.*"
            },
            {
              "status": "unaffected",
              "version": "6.17.1",
              "versionType": "semver",
              "lessThanOrEqual": "6.17.*"
            },
            {
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "sound/usb/midi.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-10-15T08:15:37.947",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/353d8c715cc951a980728133c9dd64ca5a0a186c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/647d6b8d22be12842fde6ed0c56859ebc615f21e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9f2c0ac1423d5f267e7f1d1940780fc764b0fee3",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/af600e7f5526d16146b3ae99f6ad57bfea79ca33",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/dc4874366cf6cf4a31d8fa4b7f0e2a5b2d7647ba",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e16985513e89466a236d2a7c202783b4dd0c5a46",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e63f049c7764b615d1d50cb486745fa63372b42d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Deferred",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free\n\nThe previous commit 0718a78f6a9f (\"ALSA: usb-audio: Kill timer properly at\nremoval\") patched a UAF issue caused by the error timer.\n\nHowever, because the error timer kill added in this patch occurs after the\nendpoint delete, a race condition to UAF still occurs, albeit rarely.\n\nAdditionally, since kill-cleanup for urb is also missing, freed memory can\nbe accessed in interrupt context related to urb, which can cause UAF.\n\nTherefore, to prevent this, error timer and urb must be killed before\nfreeing the heap memory."
    }
  ],
  "lastModified": "2026-06-17T09:18:59.027",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}