CVE-2025-40338

Description

A use-after-free flaw was found in the Linux kernel's Intel Audio Voice Speech (AVS) driver in the ASoC subsystem. When multiple audio components share the same name pointer directly, tearing down one component frees the memory while other components still reference it. Subsequent access to the freed name pointer leads to use-after-free, potentially causing system crashes, memory corruption, or privilege escalation.

Statement

This vulnerability affects systems with Intel audio hardware using the AVS driver. Exploitation requires local access and typically occurs during audio device initialization or teardown operations. The race condition makes exploitation timing-dependent.

Mitigation

To mitigate this issue, prevent the snd_soc_avs module from being loaded if Intel AVS audio functionality is not required. See https://access.redhat.com/solutions/41278 for instructions on how to blacklist a kernel module.

Common Vulnerability Scoring System (CVSS) Score Details

Info alert:Important note

CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).

The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 Score Breakdown

Red HatNVDcve.org
Base Score5.2N/AN/A
Attack VectorLocalN/AN/A
Attack ComplexityHighN/AN/A
Privileges RequiredHighN/AN/A
User InteractionNoneN/AN/A
ScopeUnchangedN/AN/A
ConfidentialityLowN/AN/A
Integrity ImpactLowN/AN/A
Availability ImpactHighN/AN/A

Vector

Red Hat: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.