CVE-2025-40338

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-40338", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.186Z", "datePublished": "2025-12-09T04:09:54.753Z", "dateUpdated": "2026-10-30T12:23:04.192Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:23:04.192Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: Intel: avs: Do not share the name pointer between components\n\nBy sharing 'name' directly, tearing down components may lead to\nuse-after-free errors. Duplicate the name to avoid that.\n\nAt the same time, update the order of operations - since commit\ncee28113db17 (\"ASoC: dmaengine_pcm: Allow passing component name via\nconfig\") the framework does not override component->name if set before\ninvoking the initializer."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/soc/intel/avs/pcm.c"], "versions": [{"version": "f1b3b320bd6519b16e3480f74f2926d106e3bcba", "lessThan": "0e1440e0d8b2394adfc3f1ac0710e6419600d5c1", "status": "affected", "versionType": "git"}, {"version": "f1b3b320bd6519b16e3480f74f2926d106e3bcba", "lessThan": "0a187ea7a5b4e78b9be1f9c1507cff04f3ae4ab1", "status": "affected", "versionType": "git"}, {"version": "f1b3b320bd6519b16e3480f74f2926d106e3bcba", "lessThan": "a80a82f567f7c6276d96409377d4691ea30d18a2", "status": "affected", "versionType": "git"}, {"version": "f1b3b320bd6519b16e3480f74f2926d106e3bcba", "lessThan": "128bf29c992988f8b4f3829227339908fde5ec86", "status": "affected", "versionType": "git"}, {"version": "f1b3b320bd6519b16e3480f74f2926d106e3bcba", "lessThan": "4dee5c1cc439b0d5ef87f741518268ad6a95b23d", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/soc/intel/avs/pcm.c"], "versions": [{"version": "5.19", "status": "affected"}, {"version": "0", "lessThan": "5.19", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17.8", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.12.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.17.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.18"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/0e1440e0d8b2394adfc3f1ac0710e6419600d5c1"}, {"url": "https://git.kernel.org/stable/c/0a187ea7a5b4e78b9be1f9c1507cff04f3ae4ab1"}, {"url": "https://git.kernel.org/stable/c/a80a82f567f7c6276d96409377d4691ea30d18a2"}, {"url": "https://git.kernel.org/stable/c/128bf29c992988f8b4f3829227339908fde5ec86"}, {"url": "https://git.kernel.org/stable/c/4dee5c1cc439b0d5ef87f741518268ad6a95b23d"}], "title": "ASoC: Intel: avs: Do not share the name pointer between components", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["sound/soc/intel/avs/pcm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "0e1440e0d8b2394adfc3f1ac0710e6419600d5c1", "status": "affected", "version": "f1b3b320bd6519b16e3480f74f2926d106e3bcba", "versionType": "git"}, {"lessThan": "0a187ea7a5b4e78b9be1f9c1507cff04f3ae4ab1", "status": "affected", "version": "f1b3b320bd6519b16e3480f74f2926d106e3bcba", "versionType": "git"}, {"lessThan": "a80a82f567f7c6276d96409377d4691ea30d18a2", "status": "affected", "version": "f1b3b320bd6519b16e3480f74f2926d106e3bcba", "versionType": "git"}, {"lessThan": "128bf29c992988f8b4f3829227339908fde5ec86", "status": "affected", "version": "f1b3b320bd6519b16e3480f74f2926d106e3bcba", "versionType": "git"}, {"lessThan": "4dee5c1cc439b0d5ef87f741518268ad6a95b23d", "status": "affected", "version": "f1b3b320bd6519b16e3480f74f2926d106e3bcba", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["sound/soc/intel/avs/pcm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.19"}, {"lessThan": "5.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.114", "versionType": "semver"}, {"lessThanOrEqual": "6.17.*", "status": "unaffected", "version": "6.17.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: Intel: avs: Do not share the name pointer between components\n\nBy sharing 'name' directly, tearing down components may lead to\nuse-after-free errors. Duplicate the name to avoid that.\n\nAt the same time, update the order of operations - since commit\ncee28113db17 (\"ASoC: dmaengine_pcm: Allow passing component name via\nconfig\") the framework does not override component->name if set before\ninvoking the initializer."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nASoC: Intel: avs: No compartir el puntero de nombre entre componentes\n\nAl compartir 'name' directamente, la desmantelaci\u00f3n de componentes puede llevar a errores de uso despu\u00e9s de liberaci\u00f3n. Duplicar el nombre para evitar eso.\n\nAl mismo tiempo, actualizar el orden de las operaciones - desde el commit cee28113db17 ('ASoC: dmaengine_pcm: Permitir pasar el nombre del componente a trav\u00e9s de la configuraci\u00f3n') el framework no sobrescribe component -> name si se establece antes de invocar el inicializador."}], "id": "CVE-2025-40338", "lastModified": "2026-10-30T13:18:16.697", "metrics": {}, "published": "2025-12-09T16:17:44.043", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0a187ea7a5b4e78b9be1f9c1507cff04f3ae4ab1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0e1440e0d8b2394adfc3f1ac0710e6419600d5c1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/128bf29c992988f8b4f3829227339908fde5ec86"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4dee5c1cc439b0d5ef87f741518268ad6a95b23d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a80a82f567f7c6276d96409377d4691ea30d18a2"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: ASoC: Intel: avs: Do not share the name pointer between components", "id": "2420423", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2420423"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, prevent the snd_soc_avs module from being loaded if Intel AVS audio functionality is not required. See https://access.redhat.com/solutions/41278 for instructions on how to blacklist a kernel module."}, "name": "CVE-2025-40338", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-12-09T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-40338\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-40338\nhttps://lore.kernel.org/linux-cve-announce/2025120911-CVE-2025-40338-c637@gregkh/T"], "statement": "This vulnerability affects systems with Intel audio hardware using the AVS driver. Exploitation requires local access and typically occurs during audio device initialization or teardown operations. The race condition makes exploitation timing-dependent.", "threat_severity": "Moderate"}

{}