In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: fix race condition to UAF in sndusbmidifree
The previous commit 0718a78f6a9f ("ALSA: usb-audio: Kill timer properly at removal") patched a UAF issue caused by the error timer.
However, because the error timer kill added in this patch occurs after the endpoint delete, a race condition to UAF still occurs, albeit rarely.
Additionally, since kill-cleanup for urb is also missing, freed memory can be accessed in interrupt context related to urb, which can cause UAF.
Therefore, to prevent this, error timer and urb must be killed before freeing the heap memory.
[
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@353d8c715cc951a980728133c9dd64ca5a0a186c",
"id": "CVE-2025-39997-140ad40d",
"digest": {
"function_hash": "45941995388486738199047728541078478242",
"length": 333.0
},
"target": {
"function": "snd_usbmidi_free",
"file": "sound/usb/midi.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9f2c0ac1423d5f267e7f1d1940780fc764b0fee3",
"id": "CVE-2025-39997-30199cfc",
"digest": {
"function_hash": "45941995388486738199047728541078478242",
"length": 333.0
},
"target": {
"function": "snd_usbmidi_free",
"file": "sound/usb/midi.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@af600e7f5526d16146b3ae99f6ad57bfea79ca33",
"id": "CVE-2025-39997-64039a46",
"digest": {
"line_hashes": [
"204888673182061187100320788414015186294",
"132898774735151703735714799777717689232",
"331638671471693421337260783323722430728",
"48623490834421110408684081683201919846",
"186988394750616064345993611611314632566",
"183951652287678985238731593798422613804",
"137473500099740156064156199405219613809",
"131220763596145339374069263490341494186",
"150268287827661559342236072649400200096",
"23641133313264215697829942632103746009",
"179221078614971689064321433660141623119",
"180126867460519777774945611925484658860"
],
"threshold": 0.9
},
"target": {
"file": "sound/usb/midi.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dc4874366cf6cf4a31d8fa4b7f0e2a5b2d7647ba",
"id": "CVE-2025-39997-78b54dca",
"digest": {
"line_hashes": [
"204888673182061187100320788414015186294",
"132898774735151703735714799777717689232",
"331638671471693421337260783323722430728",
"48623490834421110408684081683201919846",
"186988394750616064345993611611314632566",
"183951652287678985238731593798422613804",
"137473500099740156064156199405219613809",
"131220763596145339374069263490341494186",
"150268287827661559342236072649400200096",
"23641133313264215697829942632103746009",
"179221078614971689064321433660141623119",
"180126867460519777774945611925484658860"
],
"threshold": 0.9
},
"target": {
"file": "sound/usb/midi.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dc4874366cf6cf4a31d8fa4b7f0e2a5b2d7647ba",
"id": "CVE-2025-39997-8bc2e7d4",
"digest": {
"function_hash": "45941995388486738199047728541078478242",
"length": 333.0
},
"target": {
"function": "snd_usbmidi_free",
"file": "sound/usb/midi.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9f2c0ac1423d5f267e7f1d1940780fc764b0fee3",
"id": "CVE-2025-39997-97ece650",
"digest": {
"line_hashes": [
"204888673182061187100320788414015186294",
"132898774735151703735714799777717689232",
"331638671471693421337260783323722430728",
"48623490834421110408684081683201919846",
"186988394750616064345993611611314632566",
"183951652287678985238731593798422613804",
"137473500099740156064156199405219613809",
"131220763596145339374069263490341494186",
"150268287827661559342236072649400200096",
"23641133313264215697829942632103746009",
"179221078614971689064321433660141623119",
"180126867460519777774945611925484658860"
],
"threshold": 0.9
},
"target": {
"file": "sound/usb/midi.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@af600e7f5526d16146b3ae99f6ad57bfea79ca33",
"id": "CVE-2025-39997-984cc5b6",
"digest": {
"function_hash": "45941995388486738199047728541078478242",
"length": 333.0
},
"target": {
"function": "snd_usbmidi_free",
"file": "sound/usb/midi.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@353d8c715cc951a980728133c9dd64ca5a0a186c",
"id": "CVE-2025-39997-f318a6ad",
"digest": {
"line_hashes": [
"204888673182061187100320788414015186294",
"132898774735151703735714799777717689232",
"331638671471693421337260783323722430728",
"48623490834421110408684081683201919846",
"186988394750616064345993611611314632566",
"183951652287678985238731593798422613804",
"137473500099740156064156199405219613809",
"131220763596145339374069263490341494186",
"150268287827661559342236072649400200096",
"23641133313264215697829942632103746009",
"179221078614971689064321433660141623119",
"180126867460519777774945611925484658860"
],
"threshold": 0.9
},
"target": {
"file": "sound/usb/midi.c"
},
"signature_type": "Line",
"signature_version": "v1"
}
]