{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-38078", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:23.980Z", "datePublished": "2025-06-18T09:33:52.644Z", "dateUpdated": "2026-08-05T11:59:17.032Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:59:17.032Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: pcm: Fix race of buffer access at PCM OSS layer\n\nThe PCM OSS layer tries to clear the buffer with the silence data at\ninitialization (or reconfiguration) of a stream with the explicit call\nof snd_pcm_format_set_silence() with runtime->dma_area. But this may\nlead to a UAF because the accessed runtime->dma_area might be freed\nconcurrently, as it's performed outside the PCM ops.\n\nFor avoiding it, move the code into the PCM core and perform it inside\nthe buffer access lock, so that it won't be changed during the\noperation." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable code is reached only through local character devices — open/write/ioctl/close on the OSS emulation nodes (/dev/dsp, /dev/adsp, /dev/audio) plus a second native /dev/snd/pcmC*D* descriptor. There is no network or remote-peer path into the PCM OSS layer.\nAC:L - The attacker drives both sides of the race himself: one thread runs the OSS reconfiguration path (SNDCTL_DSP_* / write / close → snd_pcm_oss_change_params_locked) while a second thread issues SNDRV_PCM_IOCTL_HW_FREE on a native fd that shares the same snd_pcm_runtime via the O_APPEND substream-sharing path in snd_pcm_attach_substream(); the window is a full buffer-sized memset and syzbot reproduced it, and the required CONFIG_SND_PCM_OSS is enabled as a module on mainstream distributions.\nPR:L - An unprivileged local user needs only read/write access to the sound device nodes, which systemd-logind's uaccess ACL grants to the active seat user (and the audio group grants otherwise) — no capabilities, no root, and no user-namespace tricks required.\nUI:N - The attacker performs every step himself from his own threads; no victim action, no filesystem mount, and no privileged helper is involved.\nS:U - The corruption is confined to kernel memory within the same security authority as the attacking local process; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - This is a use-after-free on the PCM DMA buffer, and per standard kernel scoring a UAF gives the attacker control over the freed object's reuse — the freed pages are reallocated to other kernel objects that the attacker can groom and read back through the PCM read/mmap paths, enabling kernel memory disclosure.\nI:H - snd_pcm_format_set_silence() performs a write of an attacker-chosen length (runtime->dma_bytes) into memory that has already been freed and can be reallocated to arbitrary kernel objects, giving a controlled-offset, controlled-length heap-corruption primitive suitable for privilege escalation.\nA:H - The reported crash is a fatal \"unable to handle kernel paging request\" oops during the supervisor write in memset_orig, and the UAF can be triggered repeatedly by any local user to panic or destabilize the system." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "include/sound/pcm.h", "sound/core/oss/pcm_oss.c", "sound/core/pcm_native.c" ], "versions": [ { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "c0e05a76fc727929524ef24a19c302e6dd40233f", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "8170d8ec4efd0be352c14cb61f374e30fb0c2a25", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "10217da9644ae75cea7330f902c35fc5ba78bbbf", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "f3e14d706ec18faf19f5a6e75060e140fea05d4a", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "74d90875f3d43f3eff0e9861c4701418795d3455", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "bf85e49aaf3a3c5775ea87369ea5f159c2148db4", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "afa56c960fcb4db37f2e3399f28e9402e4e1f470", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "93a81ca0657758b607c3f4ba889ae806be9beb73", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "include/sound/pcm.h", "sound/core/oss/pcm_oss.c", "sound/core/pcm_native.c" ], "versions": [ { "version": "2.6.12", "status": "affected" }, { "version": "0", "lessThan": "2.6.12", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.294", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.238", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.185", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.141", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.93", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.31", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.14.9", "lessThanOrEqual": "6.14.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "5.4.294" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "5.10.238" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "5.15.185" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.1.141" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.6.93" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.12.31" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.14.9" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.15" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/c0e05a76fc727929524ef24a19c302e6dd40233f" }, { "url": "https://git.kernel.org/stable/c/8170d8ec4efd0be352c14cb61f374e30fb0c2a25" }, { "url": "https://git.kernel.org/stable/c/10217da9644ae75cea7330f902c35fc5ba78bbbf" }, { "url": "https://git.kernel.org/stable/c/f3e14d706ec18faf19f5a6e75060e140fea05d4a" }, { "url": "https://git.kernel.org/stable/c/74d90875f3d43f3eff0e9861c4701418795d3455" }, { "url": "https://git.kernel.org/stable/c/bf85e49aaf3a3c5775ea87369ea5f159c2148db4" }, { "url": "https://git.kernel.org/stable/c/afa56c960fcb4db37f2e3399f28e9402e4e1f470" }, { "url": "https://git.kernel.org/stable/c/93a81ca0657758b607c3f4ba889ae806be9beb73" } ], "title": "ALSA: pcm: Fix race of buffer access at PCM OSS layer", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:33:46.827Z" } } ] } }