Memory Leak Vulnerability in Linux Kernel: ASoC SOF Intel HDA Package
Summary
DEBIAN-CVE-2025-38438: In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. Affects linux versions < 6.12.41-1. Fixed in 6.12.41-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of many operating systems, managing hardware and system resources. It provides essential services for all other parts of the operating system. The ASoC (ALSA System on Chip) subsystem within the kernel supports audio devices, and the SOF (Sound Open Firmware) project aims to provide a flexible and efficient audio firmware solution. This vulnerability affects the SOF Intel HDA implementation, which is responsible for handling audio processing on Intel hardware.
Vulnerability Detail
In the Linux kernel, a memory leak was identified in the ASoC SOF Intel HDA driver. The issue arises from the improper management of memory allocated for the 'tplg_filename' variable within the 'sof_pdata' structure. Specifically, the memory allocated using 'kstrdup()' can be overwritten without being freed, leading to unreferenced memory that is not reclaimed. This vulnerability can result in increased memory usage over time, potentially leading to system instability or crashes as the memory footprint grows.
How To Fix
Minimum fixed version
6.12.41-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is advisable to apply the patch as soon as it is available to mitigate the risk of memory leaks.
Conclusion
The memory leak vulnerability in the Linux kernel's ASoC SOF Intel HDA driver poses a risk of increased memory usage and potential system instability. It is essential to update to the patched versions of the Linux package to mitigate this issue. Regular monitoring and timely updates are crucial for maintaining system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to memory leaks, which may cause increased memory consumption and potentially lead to system instability or crashes.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Yes, patches are available for Debian 13 and 14. Ensure you update to the specified versions to mitigate the vulnerability.
While there are no specific workarounds, it is crucial to monitor your system for unusual behavior and plan for an update as soon as possible.
Detailed information can be found in the Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-38438.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
