In the Linux kernel, the following vulnerability has been resolved:
ALSA: pcm: Fix races among concurrent hw_params and hw_free calls
Currently we have neither proper check nor protection against the concurrent calls of PCM hw_params and hw_free ioctls, which may result in a UAF. Since the existing PCM stream lock can't be used for protecting the whole ioctl operations, we need a new mutex to protect those racy calls.
This patch introduced a new mutex, runtime->buffer_mutex, and applies it to both hw_params and hw_free ioctl code paths. Along with it, the both functions are slightly modified (the mmap_count check is moved into the state-check block) for code simplicity.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade bpftool-debuginfoUpgrade kernelUpgrade kernel-livepatch-4.14.281-212.502Upgrade python-perf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-livepatch-5.10.109-104.500Upgrade python-perfUpgrade kernel-headersUpgrade kernel-debuginfoUpgrade perf-debuginfoUpgrade kernel-toolsUpgrade bpftoolUpgrade kernel-develUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-debuginfoUpgrade kernel-tools-develUpgrade perf | Mar 14, 2025 | Feb 26, 2025 |
| Debian | — | Upgrade linux | Feb 27, 2025 | Feb 27, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Feb 26, 2025 |
| Ubuntu | — | Upgrade linuxUpgrade linux-azure-fipsUpgrade linux-ibm-5.4Upgrade linux-aws-hweUpgrade linux-gcpUpgrade linux-bluefieldUpgrade linux-lowlatency-hwe-5.15Upgrade linux-raspi-5.4Upgrade linux-gcp-5.4Upgrade linux-aws-5.4Upgrade linux-oracle-5.4Upgrade linux-awsUpgrade linux-gkeUpgrade linux-intel-iotg-5.15Upgrade linux-lowlatencyUpgrade linux-gcp-4.15Upgrade linux-aws-fipsUpgrade linux-azure-5.15Upgrade linux-azure-4.15Upgrade linux-oracleUpgrade linux-azure-5.4Upgrade linux-intel-iotgUpgrade linux-iotUpgrade linux-realtimeUpgrade linux-ibmUpgrade linux-hweUpgrade linux-raspiUpgrade linux-hwe-5.15Upgrade linux-fipsUpgrade linux-kvmUpgrade linux-azureUpgrade linux-gcp-fipsUpgrade linux-hwe-5.4 | Mar 3, 2025 | Feb 26, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Feb 26, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub