BaseFortify

Publication date: 2025-10-15

Last updated on: 2026-06-01

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free The previous commit 0718a78f6a9f ("ALSA: usb-audio: Kill timer properly at removal") patched a UAF issue caused by the error timer. However, because the error timer kill added in this patch occurs after the endpoint delete, a race condition to UAF still occurs, albeit rarely. Additionally, since kill-cleanup for urb is also missing, freed memory can be accessed in interrupt context related to urb, which can cause UAF. Therefore, to prevent this, error timer and urb must be killed before freeing the heap memory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-15

Last Modified

2026-06-01

Generated

2026-07-06

AI Q&A

2025-10-15

EPSS Evaluated

2026-07-04

NVD

CVE-2025-39997

Affected Vendors & Products

Vendor	Product	Version / Range
linux	kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is a race condition leading to a Use-After-Free (UAF) in the Linux kernel's ALSA usb-audio driver. Specifically, the issue arises because the error timer is killed after the USB endpoint is deleted, which can cause rare race conditions where freed memory is accessed. Additionally, missing cleanup for USB Request Blocks (urb) means that freed memory can be accessed in interrupt context, potentially causing UAF. The fix involves killing the error timer and urb before freeing the heap memory to prevent these race conditions.

Impact Analysis

This vulnerability can lead to Use-After-Free conditions in the Linux kernel's usb-audio subsystem, which may cause system instability, crashes, or potentially allow an attacker to execute arbitrary code or escalate privileges by exploiting the freed memory access in interrupt context.

Mitigation Strategies

To mitigate this vulnerability, update the Linux kernel to a version that includes the fix for the ALSA usb-audio race condition and use-after-free (UAF) issue. The fix involves proper killing of the error timer and urb before freeing heap memory to prevent race conditions. Applying the latest kernel patches or updates from your Linux distribution vendor is recommended.

Hi! I’m here to help you understand CVE-2025-39997. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70