linux-cve-announce - CVE-2025-39997: ALSA: usb-audio: fix race condition to UAF in snd_usbmidi

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025101528-CVE-2025-39997-4384@gregkh>
Date: Wed, 15 Oct 2025 09:58:34 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-39997: ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free

The previous commit 0718a78f6a9f ("ALSA: usb-audio: Kill timer properly at
removal") patched a UAF issue caused by the error timer.

However, because the error timer kill added in this patch occurs after the
endpoint delete, a race condition to UAF still occurs, albeit rarely.

Additionally, since kill-cleanup for urb is also missing, freed memory can
be accessed in interrupt context related to urb, which can cause UAF.

Therefore, to prevent this, error timer and urb must be killed before
freeing the heap memory.

The Linux kernel CVE team has assigned CVE-2025-39997 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.16 with commit 0718a78f6a9f04b88d0dc9616cc216b31c5f3cf1 and fixed in 6.16.11 with commit af600e7f5526d16146b3ae99f6ad57bfea79ca33
	Issue introduced in 6.16 with commit 0718a78f6a9f04b88d0dc9616cc216b31c5f3cf1 and fixed in 6.17.1 with commit 353d8c715cc951a980728133c9dd64ca5a0a186c
	Issue introduced in 6.16 with commit 0718a78f6a9f04b88d0dc9616cc216b31c5f3cf1 and fixed in 6.18-rc1 with commit 9f2c0ac1423d5f267e7f1d1940780fc764b0fee3
	Issue introduced in 6.15.3 with commit 62066758d2ae169278e5d6aea5995b1b6f6ddeb5

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-39997
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	sound/usb/midi.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/dc4874366cf6cf4a31d8fa4b7f0e2a5b2d7647ba
	https://git.kernel.org/stable/c/647d6b8d22be12842fde6ed0c56859ebc615f21e
	https://git.kernel.org/stable/c/af600e7f5526d16146b3ae99f6ad57bfea79ca33
	https://git.kernel.org/stable/c/353d8c715cc951a980728133c9dd64ca5a0a186c
	https://git.kernel.org/stable/c/9f2c0ac1423d5f267e7f1d1940780fc764b0fee3