What’s Vulnerable › Vulnerabilities

CVE-2025-39997: ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free

• Severity: unknown
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-10-15 · updated 2026-10-19

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free The previous commit 0718a78f6a9f ("ALSA: usb-audio: Kill timer properly at removal") patched a UAF issue caused by the error timer. However, because the error timer kill added in this patch occurs after the endpoint delete, a race condition to UAF still occurs, albeit rarely. Additionally, since kill-cleanup for urb is also missing, freed memory can be accessed in interrupt context related to urb, which can cause UAF. Therefore, to prevent this, error timer and urb must be killed before freeing the heap memory.

Affected products

• Linux kernel: from 6.1.167 before 6.1.175; from 6.15.3 before 6.16; 6.16 — fixed in 6.1.175, 6.16, 6.18

How to fix

Upgrade to a fixed version: Linux kernel 6.1.175, 6.16, 6.18. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/353d8c715cc951a980728133c9dd64ca5a0a186c
• https://git.kernel.org/stable/c/647d6b8d22be12842fde6ed0c56859ebc615f21e
• https://git.kernel.org/stable/c/9f2c0ac1423d5f267e7f1d1940780fc764b0fee3
• https://git.kernel.org/stable/c/af600e7f5526d16146b3ae99f6ad57bfea79ca33
• https://git.kernel.org/stable/c/dc4874366cf6cf4a31d8fa4b7f0e2a5b2d7647ba
• https://git.kernel.org/stable/c/e16985513e89466a236d2a7c202783b4dd0c5a46
• https://git.kernel.org/stable/c/e63f049c7764b615d1d50cb486745fa63372b42d
• https://cert-portal.siemens.com/productcert/html/ssa-784472.html

Get alerted when CVE-2025-39997 or the next vulnerability affects your stack