Log in Start free

Vulnerability · Published Jun 18, 2025 · Assigned by Linux

CVE-2025-38056ASoC: SOF: Intel: hda: Fix UAF when reloading module

High 7.8

In plain English

A high-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.8High
Exploit odds (30 days)0.2%top 90.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: hda: Fix UAF when reloading module hda_generic_machine_select() appends -idisp to the tplg filename by allocating a new string with devm_kasprintf(), then stores the string right back into the global variable snd_soc_acpi_intel_hda_machines. When the module is unloaded, this memory is freed, resulting in a global variable pointing to freed memory. Reloading the module then triggers a use-after-free: BUG: KFENCE: use-after-free read in string+0x48/0xe0 Use-after-free read at 0x00000000967e0109 (in kfence-#99): string+0x48/0xe0 vsnprintf+0x329/0x6e0 devm_kvasprintf+0x54/0xb0 devm_kasprintf+0x58/0x80 hda_machine_select.cold+0x198/0x17a2 [snd_sof_intel_hda_generic] sof_probe_work+0x7f/0x600 [snd_sof] process_one_work+0x17b/0x330 worker_thread+0x2ce/0x3f0 kthread+0xcf/0x100 ret_from_fork+0x31/0x50 ret_from_fork_asm+0x1a/0x30 kfence-#99: 0x00000000198a940f-0x00000000ace47d9d, size=64, cache=kmalloc-64 allocated by task 333 on cpu 8 at 17.798069s (130.453553s ago): devm_kmalloc+0x52/0x120 devm_kvasprintf+0x66/0xb0 devm_kasprintf+0x58/0x80 hda_machine_select.cold+0x198/0x17a2 [snd_sof_intel_hda_generic] sof_probe_work+0x7f/0x600 [snd_sof] process_one_work+0x17b/0x330 worker_thread+0x2ce/0x3f0 kthread+0xcf/0x100 ret_from_fork+0x31/0x50 ret_from_fork_asm+0x1a/0x30 freed by task 1543 on cpu 4 at 141.586686s (6.665010s ago): release_nodes+0x43/0xb0 devres_release_all+0x90/0xf0 device_unbind_cleanup+0xe/0x70 device_release_driver_internal+0x1c1/0x200 driver_detach+0x48/0x90 bus_remove_driver+0x6d/0xf0 pci_unregister_driver+0x42/0xb0 __do_sys_delete_module+0x1d1/0x310 do_syscall_64+0x82/0x190 entry_SYSCALL_64_after_hwframe+0x76/0x7e Fix it by copying the match array with devm_kmemdup_array() before we modify it.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13linux6.12.32-1DEBIAN-CVE-2025-38056
Debian:14linux6.12.32-1DEBIAN-CVE-2025-38056
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2025-38056
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2025-38056
Ubuntu:24.04:LTSlinux-aws-6.146.14.0-1011.11~24.04.1UBUNTU-CVE-2025-38056
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2025-38056
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2025-38056
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2025-38056
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2025-38056
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2025-38056
Ubuntu:25.10linux-azure-fdeno fix listedUBUNTU-CVE-2025-38056
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2025-38056
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2025-38056
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2025-38056
Ubuntu:24.04:LTSlinux-gcp-6.146.14.0-1014.15~24.04.1UBUNTU-CVE-2025-38056
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2025-38056
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2025-38056
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2025-38056
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2025-38056
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2025-38056
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2025-38056
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2025-38056
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2025-38056
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2025-38056
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2025-38056
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2025-38056
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2025-38056
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2025-38056
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2025-38056
Ubuntu:24.04:LTSlinux-oem-6.146.14.0-1010.10UBUNTU-CVE-2025-38056
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2025-38056
Ubuntu:24.04:LTSlinux-oracle-6.146.14.0-1011.11~24.04.1UBUNTU-CVE-2025-38056
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2025-38056
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2025-38056
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2025-38056
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2025-38056
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2025-38056
Ubuntu:24.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2025-38056
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2025-38056
Ubuntu:24.04:LTSlinux-riscv-6.146.14.0-28.28.1~24.04.1UBUNTU-CVE-2025-38056
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2025-38056
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2025-38056
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2025-38056
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2025-38056

Affected products (as reported)

VendorProductVersions
Linux Linux 5458411d75947a4212e50a401ec0a98d4c6c931b – before 2b49e68360eb6a1c03dc1642a51f7d9f6784c0345458411d75947a4212e50a401ec0a98d4c6c931b – before f9670b2e81e8a3cbf2e1e757190dd0b920a9d43f5458411d75947a4212e50a401ec0a98d4c6c931b – before 7dd7f39fce0022b386ef1ea5ffef92ecc7dfc6af
Linux Linux 6.12

References