Linux Kernel up to 6.15.2 ALSA snd_usbmidi_free initialization

Summaryinfo

A vulnerability has been found in Linux Kernel up to 6.15.2 and classified as problematic. This issue affects the function snd_usbmidi_free of the component ALSA. The manipulation leads to initialization. This vulnerability is documented as CVE-2025-38105. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Linux Kernel up to 6.15.2 and classified as problematic. This issue affects the function snd_usbmidi_free of the component ALSA. The manipulation with an unknown input leads to a initialization vulnerability. Using CWE to declare the problem leads to CWE-665. The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used. The impact remains unknown. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Kill timer properly at removal The USB-audio MIDI code initializes the timer, but in a rare case, the driver might be freed without the disconnect call. This leaves the timer in an active state while the assigned object is released via snd_usbmidi_free(), which ends up with a kernel warning when the debug configuration is enabled, as spotted by fuzzer. For avoiding the problem, put timer_shutdown_sync() at snd_usbmidi_free(), so that the timer can be killed properly. While we're at it, replace the existing timer_delete_sync() at the disconnect callback with timer_shutdown_sync(), too.

The advisory is shared at git.kernel.org. The identification of this vulnerability is CVE-2025-38105 since 04/16/2025. Technical details are known, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 253428 (SUSE SLES15 Security Update : kernel (SUSE-SU-2025:02923-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.15.3 or 6.16-rc1 eliminates this vulnerability. Applying the patch 62066758d2ae169278e5d6aea5995b1b6f6ddeb5/0718a78f6a9f04b88d0dc9616cc216b31c5f3cf1 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (253428), EUVD (EUVD-2025-19838) and CERT Bund (WID-SEC-2025-1452). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Affected

• Google Container-Optimized OS
• Debian Linux
• Amazon Linux 2
• Red Hat Enterprise Linux
• Ubuntu Linux
• SUSE Linux
• Oracle Linux
• IBM QRadar SIEM
• SUSE openSUSE
• RESF Rocky Linux
• Dell Avamar
• Open Source Linux Kernel
• Dell NetWorker
• Dell Secure Connect Gateway

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.15.0
• 6.15.1
• 6.15.2

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion