Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2025-40338

Опубликовано: 09 дек. 2025
Источник: redhat
CVSS3: 5.2
EPSS Низкий

Описание

In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Do not share the name pointer between components By sharing 'name' directly, tearing down components may lead to use-after-free errors. Duplicate the name to avoid that. At the same time, update the order of operations - since commit cee28113db17 ("ASoC: dmaengine_pcm: Allow passing component name via config") the framework does not override component->name if set before invoking the initializer.

A use-after-free flaw was found in the Linux kernel's Intel Audio Voice Speech (AVS) driver in the ASoC subsystem. When multiple audio components share the same name pointer directly, tearing down one component frees the memory while other components still reference it. Subsequent access to the freed name pointer leads to use-after-free, potentially causing system crashes, memory corruption, or privilege escalation.

Отчет

This vulnerability affects systems with Intel audio hardware using the AVS driver. Exploitation requires local access and typically occurs during audio device initialization or teardown operations. The race condition makes exploitation timing-dependent.

Меры по смягчению последствий

To mitigate this issue, prevent the snd_soc_avs module from being loaded if Intel AVS audio functionality is not required. See https://access.redhat.com/solutions/41278 for instructions on how to blacklist a kernel module.

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
Red Hat Enterprise Linux 10kernelFix deferred
Red Hat Enterprise Linux 6kernelNot affected
Red Hat Enterprise Linux 7kernelNot affected
Red Hat Enterprise Linux 7kernel-rtNot affected
Red Hat Enterprise Linux 8kernelFix deferred
Red Hat Enterprise Linux 8kernel-rtFix deferred
Red Hat Enterprise Linux 9kernelFix deferred
Red Hat Enterprise Linux 9kernel-rtFix deferred

Показывать по

Дополнительная информация

Статус:

Moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2420423kernel: ASoC: Intel: avs: Do not share the name pointer between components

EPSS

Процентиль: 8%
0.00027
Низкий

5.2 Medium

CVSS3

Связанные уязвимости

ubuntu
4 месяца назад

In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Do not share the name pointer between components By sharing 'name' directly, tearing down components may lead to use-after-free errors. Duplicate the name to avoid that. At the same time, update the order of operations - since commit cee28113db17 ("ASoC: dmaengine_pcm: Allow passing component name via config") the framework does not override component->name if set before invoking the initializer.

nvd
4 месяца назад

In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Do not share the name pointer between components By sharing 'name' directly, tearing down components may lead to use-after-free errors. Duplicate the name to avoid that. At the same time, update the order of operations - since commit cee28113db17 ("ASoC: dmaengine_pcm: Allow passing component name via config") the framework does not override component->name if set before invoking the initializer.

msrc
4 месяца назад

ASoC: Intel: avs: Do not share the name pointer between components

debian
4 месяца назад

In the Linux kernel, the following vulnerability has been resolved: A ...

github
4 месяца назад

In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Do not share the name pointer between components By sharing 'name' directly, tearing down components may lead to use-after-free errors. Duplicate the name to avoid that. At the same time, update the order of operations - since commit cee28113db17 ("ASoC: dmaengine_pcm: Allow passing component name via config") the framework does not override component->name if set before invoking the initializer.

EPSS

Процентиль: 8%
0.00027
Низкий

5.2 Medium

CVSS3