CVE-2025-39997
Deferred Deferred - Pending Action
BaseFortify

Publication date: 2025-10-15

Last updated on: 2026-06-01

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free The previous commit 0718a78f6a9f ("ALSA: usb-audio: Kill timer properly at removal") patched a UAF issue caused by the error timer. However, because the error timer kill added in this patch occurs after the endpoint delete, a race condition to UAF still occurs, albeit rarely. Additionally, since kill-cleanup for urb is also missing, freed memory can be accessed in interrupt context related to urb, which can cause UAF. Therefore, to prevent this, error timer and urb must be killed before freeing the heap memory.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-15
Last Modified
2026-06-01
Generated
2026-06-16
AI Q&A
2025-10-15
EPSS Evaluated
2026-06-14
NVD
CVE-2025-39997
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a race condition leading to a Use-After-Free (UAF) in the Linux kernel's ALSA usb-audio driver. Specifically, the issue arises because the error timer is killed after the USB endpoint is deleted, which can cause rare race conditions where freed memory is accessed. Additionally, missing cleanup for USB Request Blocks (urb) means that freed memory can be accessed in interrupt context, potentially causing UAF. The fix involves killing the error timer and urb before freeing the heap memory to prevent these race conditions.

Impact Analysis

This vulnerability can lead to Use-After-Free conditions in the Linux kernel's usb-audio subsystem, which may cause system instability, crashes, or potentially allow an attacker to execute arbitrary code or escalate privileges by exploiting the freed memory access in interrupt context.

Mitigation Strategies

To mitigate this vulnerability, update the Linux kernel to a version that includes the fix for the ALSA usb-audio race condition and use-after-free (UAF) issue. The fix involves proper killing of the error timer and urb before freeing heap memory to prevent race conditions. Applying the latest kernel patches or updates from your Linux distribution vendor is recommended.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-39997. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart