In the Linux kernel, the following vulnerability has been resolved:
ASoC: core: Fix use-after-free in snd_soc_exit()
KASAN reports a use-after-free:
BUG: KASAN: use-after-free in device_del+0xb5b/0xc60 Read of size 8 at addr ffff888008655050 by task rmmod/387 CPU: 2 PID: 387 Comm: rmmod Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) Call Trace: <TASK> dump_stack_lvl+0x79/0x9a print_report+0x17f/0x47b kasan_report+0xbb/0xf0 device_del+0xb5b/0xc60 platform_device_del.part.0+0x24/0x200 platform_device_unregister+0x2e/0x40 snd_soc_exit+0xa/0x22 [snd_soc_core] __do_sys_delete_module.constprop.0+0x34f/0x5b0 do_syscall_64+0x3a/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd ... </TASK>
It's bacause in snd_soc_init(), snd_soc_util_init() is possble to fail, but its ret is ignored, which makes soc_dummy_dev unregistered twice.
snd_soc_init() snd_soc_util_init() platform_device_register_simple(soc_dummy_dev) platform_driver_register() # fail platform_device_unregister(soc_dummy_dev) platform_driver_register() # success ... snd_soc_exit() snd_soc_util_exit() # soc_dummy_dev will be unregistered for second time
To fix it, handle error and stop snd_soc_init() when util_init() fail. Also clean debugfs when util_init() or driver_register() fail.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade perfUpgrade kernel-develUpgrade kernel-headersUpgrade kernel-livepatch-5.10.157-139.675Upgrade kernel-tools-develUpgrade kernelUpgrade kernel-tools-debuginfoUpgrade kernel-livepatch-4.14.301-224.520Upgrade bpftool-debuginfoUpgrade bpftoolUpgrade kernel-debuginfoUpgrade python-perf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-toolsUpgrade python-perf | May 22, 2025 | May 1, 2025 |
| Debian | — | Upgrade linux | May 5, 2025 | May 1, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 1, 2025 |
| Ubuntu | — | Upgrade linux-gcp-4.15Upgrade linux-oracle-5.15Upgrade linux-ibm-5.4Upgrade linux-aws-5.15Upgrade linux-gcp-5.4Upgrade linux-oracle-5.4Upgrade linux-aws-hweUpgrade linux-nvidia-tegra-5.15Upgrade linux-azure-5.15Upgrade linux-gkeUpgrade linux-raspiUpgrade linux-azureUpgrade linux-aws-fipsUpgrade linux-hwe-5.4Upgrade linux-hwe-5.15Upgrade linux-azure-5.4Upgrade linux-gkeopUpgrade linuxUpgrade linux-aws-5.4Upgrade linux-ibmUpgrade linux-azure-4.15Upgrade linux-iotUpgrade linux-lowlatencyUpgrade linux-azure-fipsUpgrade linux-gcpUpgrade linux-intel-iotg-5.15Upgrade linux-intel-iot-realtimeUpgrade linux-realtimeUpgrade linux-bluefieldUpgrade linux-kvmUpgrade linux-fipsUpgrade linux-nvidiaUpgrade linux-oracleUpgrade linux-xilinx-zynqmpUpgrade linux-intel-iotgUpgrade linux-lowlatency-hwe-5.15Upgrade linux-gcp-fipsUpgrade linux-gcp-5.15Upgrade linux-hweUpgrade linux-awsUpgrade linux-raspi-5.4Upgrade linux-riscv-5.15 | May 6, 2025 | May 1, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | May 1, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub