{"id":"CVE-2025-39997","revision":"0af48a6492584309876c17b6540073e6","records":[{"revision":"0af48a6492584309876c17b6540073e6","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-39997","aliases":[],"title":"ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free\n\nThe previous commit 0718a78f6a9f (\"ALSA: usb-audio: Kill timer properly at\nremoval\") patched a UAF issue caused by the error timer.\n\nHowever, because the error timer kill added in this patch occurs after the\nendpoint delete, a race condition to UAF still occurs, albeit rarely.\n\nAdditionally, since kill-cleanup for urb is also missing, freed memory can\nbe accessed in interrupt context related to urb, which can cause UAF.\n\nTherefore, to prevent this, error timer and urb must be killed before\nfreeing the heap memory.","state":0,"publishedAt":"2025-10-15T07:58:21.702+00:00","modifiedAt":"2026-10-15T01:08:48.788+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"sound/usb/midi.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"06513dd6d32c37d0364db8488cfdf3e14da238a8\",\n                            \"lessThan\": \"e63f049c7764b615d1d50cb486745fa63372b42d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"efaf61052b8ff9ee8968912fbaf02c2847c78ede\",\n                            \"lessThan\": \"e16985513e89466a236d2a7c202783b4dd0c5a46\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"647410a7da46067953a53c0d03f8680eff570959\",\n                            \"lessThan\": \"dc4874366cf6cf4a31d8fa4b7f0e2a5b2d7647ba\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c611b9e55174e439dcd85a72969b43a95f3827a4\",\n                            \"lessThan\": \"647d6b8d22be12842fde6ed0c56859ebc615f21e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"0718a78f6a9f04b88d0dc9616cc216b31c5f3cf1\",\n                            \"lessThan\": \"af600e7f5526d16146b3ae99f6ad57bfea79ca33\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"0718a78f6a9f04b88d0dc9616cc216b31c5f3cf1\",\n                            \"lessThan\": \"353d8c715cc951a980728133c9dd64ca5a0a186c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"0718a78f6a9f04b88d0dc9616cc216b31c5f3cf1\",\n                            \"lessThan\": \"9f2c0ac1423d5f267e7f1d1940780fc764b0fee3\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"62066758d2ae169278e5d6aea5995b1b6f6ddeb5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6.1.167\",\n                            \"lessThan\": \"6.1.175\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.15.3\",\n                            \"lessThan\": \"6.16\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"sound/usb/midi.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.16\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.16\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.175\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.16.11\",\n                            \"lessThanOrEqual\": \"6.16.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.17.1\",\n                            \"lessThanOrEqual\": \"6.17.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/e63f049c7764b615d1d50cb486745fa63372b42d","https://git.kernel.org/stable/c/e16985513e89466a236d2a7c202783b4dd0c5a46","https://git.kernel.org/stable/c/dc4874366cf6cf4a31d8fa4b7f0e2a5b2d7647ba","https://git.kernel.org/stable/c/647d6b8d22be12842fde6ed0c56859ebc615f21e","https://git.kernel.org/stable/c/af600e7f5526d16146b3ae99f6ad57bfea79ca33","https://git.kernel.org/stable/c/353d8c715cc951a980728133c9dd64ca5a0a186c","https://git.kernel.org/stable/c/9f2c0ac1423d5f267e7f1d1940780fc764b0fee3"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-39997","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-39997","identifiers":["CVE-2025-39997"]},"retained":false,"historicalAffected":[]}],"coverage":[]}