CVE-2025-23134: ALSA: timer: Don't take register_mutex with copy_from/to_user()
In the Linux kernel, the following vulnerability has been resolved:
ALSA: timer: Don't take registermutex with copyfrom/touser()
The infamous mmaplock taken in copyfrom/touser() can be often problematic when it's called inside another mutex, as they might lead to deadlocks.
In the case of ALSA timer code, the bad pattern is with guard(mutex)(®istermutex) that covers copyfrom/touser() -- which was mistakenly introduced at converting to guard(), and it had been carefully worked around in the past.
This patch fixes those pieces simply by moving copyfrom/touser() out of the register mutex lock again.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-23134?
CVE-2025-23134 is classified as a moderate severity vulnerability due to the potential for deadlocks in the Linux kernel.
How do I fix CVE-2025-23134?
To fix CVE-2025-23134, ensure you update to the latest patched version of the Linux kernel provided by your distribution.
What systems are affected by CVE-2025-23134?
CVE-2025-23134 affects various versions of the Linux kernel that implement ALSA timer functions.
What type of vulnerability is CVE-2025-23134?
CVE-2025-23134 is a concurrency-related vulnerability that can lead to deadlocks during user data transfers.
Is CVE-2025-23134 being actively exploited?
As of now, there have been no reports indicating that CVE-2025-23134 is actively being exploited in the wild.