Use-After-Free Vulnerability in Linux Kernel: ASoC Intel HDA Module
Summary
DEBIAN-CVE-2025-38056: In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: hda: Fix UAF when reloading module hda_generic_machine_select() appends -idisp to the tplg filename by allocating a new string with de... Affects linux versions < 6.12.32-1. Fixed in 6.12.32-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, managing hardware resources and providing essential services for software applications. It supports a wide range of hardware and is known for its stability and performance. The kernel's ASoC (ALSA System on Chip) subsystem facilitates audio processing on various hardware platforms. This vulnerability specifically affects the Intel HDA (High Definition Audio) module, which is responsible for managing audio devices and their interactions with the kernel.
Vulnerability Detail
In the Linux kernel, a use-after-free vulnerability has been identified in the ASoC Intel HDA module. This issue arises when the function hda_generic_machine_select() allocates a new string for the topology filename using devm_kasprintf() and stores it in a global variable. Upon unloading the module, the memory is freed, leaving the global variable pointing to freed memory. When the module is reloaded, this leads to a use-after-free condition, potentially allowing an attacker to exploit the freed memory, resulting in undefined behavior, crashes, or arbitrary code execution.
How To Fix
Minimum fixed version
6.12.32-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate the risk.
Conclusion
The identified use-after-free vulnerability in the Linux kernel's ASoC Intel HDA module poses significant risks to system stability and security. It is crucial for users to update their systems to the patched version to mitigate these risks. Regular updates and monitoring for vulnerabilities are essential practices for maintaining a secure computing environment.
See every vulnerability recorded for linux →
FAQ
A use-after-free vulnerability occurs when a program continues to use a pointer after the memory it points to has been freed. This can lead to crashes or exploitation by attackers.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply using a manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
Exploitation of this vulnerability could lead to system crashes, unauthorized access, or arbitrary code execution, compromising the integrity and security of the system.
While the primary risk is system instability and potential exploitation, there is also a risk of data loss if the system crashes or behaves unpredictably due to the vulnerability.
It is recommended to regularly check for updates and apply them promptly, especially when vulnerabilities are disclosed, to ensure your system remains secure.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
