Linux Kernel Vulnerability: Uninitialized Work Structs in Virtio Sound
Summary
CVE-2025-37805: In the Linux kernel, the following vulnerability has been resolved: sound/virtio: Fix cancel_sync warnings on uninitialized work_structs Betty reported hitting the following warning: [ 8.709131][ T221] WARNING: CPU: 2 PI... Affects linux versions < 6.1.137-1. Fixed in 6.1.137-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interactions. It supports a wide range of functionalities, including process management, memory management, and device drivers. The 'virtio' subsystem is designed to facilitate efficient communication between virtual machines and the host system. This vulnerability specifically affects the 'virtio_snd' driver, which handles sound devices in virtualized environments, making it crucial for audio functionality in virtual machines.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the 'virtio_snd' driver where uninitialized work_structs can lead to warnings during operation. This issue arises when the driver encounters an error during initialization, causing it to exit without properly initializing the elapsed_period work_struct. As a result, subsequent calls to cancel_work_sync() on this uninitialized structure trigger warnings, indicating potential instability or unexpected behavior in the system. The vulnerability was reported by Betty and has been addressed with a patch that ensures proper initialization of the work_struct to prevent such warnings.
How To Fix
Minimum fixed version
6.1.137-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, users are advised to monitor their systems for any unusual behavior and apply the patch as soon as it becomes available.
Conclusion
The CVE-2025-37805 vulnerability in the Linux kernel's virtio_snd driver highlights the importance of proper initialization of data structures to prevent warnings and potential instability. Users are encouraged to update their systems to the patched version to mitigate any risks associated with this issue.
See every vulnerability recorded for linux →
FAQ
CVE-2025-37805 is a vulnerability in the Linux kernel's virtio_snd driver that can lead to warnings due to uninitialized work_structs.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
The primary impact is the generation of warnings during operation, which may indicate underlying instability or unexpected behavior in the system.
Yes, a patch has been released that addresses the issue by ensuring proper initialization of the work_struct in the virtio_snd driver.
While there are no specific workarounds, it is advisable to monitor your system for unusual behavior and plan to apply the patch as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
