In the Linux kernel, the following vulnerability has been resolved:
ASoC: core: Fix use-after-free in snd_soc_exit()
KASAN reports a use-after-free:
BUG: KASAN: use-after-free in device_del+0xb5b/0xc60 Read of size 8 at addr ffff888008655050 by task rmmod/387 CPU: 2 PID: 387 Comm: rmmod Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) Call Trace: <TASK> dump_stack_lvl+0x79/0x9a print_report+0x17f/0x47b kasan_report+0xbb/0xf0 device_del+0xb5b/0xc60 platform_device_del.part.0+0x24/0x200 platform_device_unregister+0x2e/0x40 snd_soc_exit+0xa/0x22 [snd_soc_core] __do_sys_delete_module.constprop.0+0x34f/0x5b0 do_syscall_64+0x3a/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd ... </TASK>
It's bacause in snd_soc_init(), snd_soc_util_init() is possble to fail, but its ret is ignored, which makes soc_dummy_dev unregistered twice.
snd_soc_init() snd_soc_util_init() platform_device_register_simple(soc_dummy_dev) platform_driver_register() # fail platform_device_unregister(soc_dummy_dev) platform_driver_register() # success ... snd_soc_exit() snd_soc_util_exit() # soc_dummy_dev will be unregistered for second time
To fix it, handle error and stop snd_soc_init() when util_init() fail. Also clean debugfs when util_init() or driver_register() fail.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernelUpgrade bpftool-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-toolsUpgrade python-perfUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-livepatch-4.14.301-224.520Upgrade kernel-debuginfoUpgrade bpftoolUpgrade python-perf-debuginfoUpgrade perfUpgrade perf-debuginfoUpgrade kernel-develUpgrade kernel-livepatch-5.10.157-139.675Upgrade kernel-debuginfo-common-aarch64Upgrade kernel-headersUpgrade kernel-tools-devel | May 22, 2025 | May 1, 2025 |
| Debian | — | Upgrade linux | May 5, 2025 | May 1, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 1, 2025 |
| Ubuntu | — | Upgrade linux-bluefieldUpgrade linux-kvmUpgrade linux-nvidiaUpgrade linux-awsUpgrade linux-raspi-5.4Upgrade linux-xilinx-zynqmpUpgrade linux-intel-iotg-5.15Upgrade linux-riscv-5.15Upgrade linux-gcp-fipsUpgrade linux-gcpUpgrade linux-intel-iot-realtimeUpgrade linux-lowlatency-hwe-5.15Upgrade linux-fipsUpgrade linux-oracleUpgrade linux-hweUpgrade linux-intel-iotgUpgrade linux-gcp-5.15Upgrade linux-realtimeUpgrade linux-hwe-5.4Upgrade linux-lowlatencyUpgrade linux-azure-5.15Upgrade linux-aws-5.15Upgrade linux-aws-hweUpgrade linux-nvidia-tegra-5.15Upgrade linux-ibm-5.4Upgrade linux-gkeUpgrade linux-gcp-4.15Upgrade linux-azureUpgrade linuxUpgrade linux-gcp-5.4Upgrade linux-raspiUpgrade linux-oracle-5.4Upgrade linux-gkeopUpgrade linux-azure-fipsUpgrade linux-aws-fipsUpgrade linux-iotUpgrade linux-ibmUpgrade linux-hwe-5.15Upgrade linux-azure-4.15Upgrade linux-azure-5.4Upgrade linux-aws-5.4Upgrade linux-oracle-5.15 | May 6, 2025 | May 1, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | May 1, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub