Double Free Vulnerability in Linux Kernel: ASoC Codecs WCD9375
Summary
DEBIAN-CVE-2025-38423: In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: wcd9375: Fix double free of regulator supplies Driver gets regulator supplies in probe path with devm_regulator_bulk_get(), so should not... Affects linux versions < 6.12.35-1. Fixed in 6.12.35-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware management and system operations. It supports a wide range of hardware and is known for its stability and performance. The ASoC (ALSA System on Chip) subsystem is responsible for managing audio devices on SoC platforms. This vulnerability affects the WCD9375 audio codec driver, which improperly handles regulator supplies, leading to potential system instability.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the ASoC subsystem related to the WCD9375 audio codec driver. The issue arises from the improper handling of regulator supplies, where the driver calls 'regulator_bulk_free()' in error and remove paths after obtaining supplies with 'devm_regulator_bulk_get()'. This can lead to a double free scenario, potentially causing memory corruption and system crashes, thereby compromising system integrity and reliability.
How To Fix
Minimum fixed version
6.12.35-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating to the fixed version.
Conclusion
The identified vulnerability in the Linux kernel's ASoC subsystem poses a significant risk due to improper handling of regulator supplies in the WCD9375 audio codec driver. Users are strongly encouraged to update to the patched version 6.12.35-1 to mitigate potential risks associated with this vulnerability.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to memory corruption and system crashes, affecting the stability and reliability of the operating system.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities. Visit Vulert Scanner to check if your application is affected without any signup.
While there are no specific workarounds, it is advisable to monitor the system for unusual behavior and apply the update as soon as possible.
This vulnerability affects the Linux kernel across Debian distributions, specifically versions 13 and 14.
Detailed information can be found in the official Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-38423.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
