CVE-2025-39765: ALSA: timer: fix ida_free call while not allocated
In the Linux kernel, the following vulnerability has been resolved:
ALSA: timer: fix idafree call while not allocated
In the sndutimercreate() function, if the kasprintf() function return NULL, sndutimerputid() will be called, finally use idafree() to free the unallocated id 0.
the syzkaller reported the following information: ------------[ cut here ]------------ idafree called for id=0 which is not allocated. WARNING: CPU: 1 PID: 1286 at lib/idr.c:592 idafree+0x1fd/0x2f0 lib/idr.c:592 Modules linked in: CPU: 1 UID: 0 PID: 1286 Comm: syz-executor164 Not tainted 6.15.8 #3 PREEMPT(lazy) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-4.fc42 04/01/2014 RIP: 0010:idafree+0x1fd/0x2f0 lib/idr.c:592 Code: f8 fc 41 83 fc 3e 76 69 e8 70 b2 f8 (...) RSP: 0018:ffffc900007f79c8 EFLAGS: 00010282 RAX: 0000000000000000 RBX: 1ffff920000fef3b RCX: ffffffff872176a5 RDX: ffff88800369d200 RSI: 0000000000000000 RDI: ffff88800369d200 RBP: 0000000000000000 R08: ffffffff87ba60a5 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000002 R14: 0000000000000000 R15: 0000000000000000 FS: 00007f6f1abc1740(0000) GS:ffff8880d76a0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f6f1ad7a784 CR3: 000000007a6e2000 CR4: 00000000000006f0 Call Trace: <TASK> sndutimerputid sound/core/timer.c:2043 [inline] [sndtimer] sndutimercreate+0x59b/0x6a0 sound/core/timer.c:2184 [sndtimer] sndutimerioctlcreate sound/core/timer.c:2202 [inline] [sndtimer] sndtimeruserioctl.isra.0+0x724/0x1340 sound/core/timer.c:2287 [sndtimer] sndtimeruserioctl+0x75/0xc0 sound/core/timer.c:2298 [sndtimer] vfsioctl fs/ioctl.c:51 [inline] dosysioctl fs/ioctl.c:907 [inline] sesysioctl fs/ioctl.c:893 [inline] x64sysioctl+0x198/0x200 fs/ioctl.c:893 dosyscallx64 arch/x86/entry/syscall64.c:63 [inline] dosyscall64+0x7b/0x160 arch/x86/entry/syscall64.c:94 entrySYSCALL64afterhwframe+0x76/0x7e [...]
The utimer->id should be set properly before the kasprintf() function, ensures the sndutimerputid() function will free the allocated id.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-39765?
CVE-2025-39765 has been classified as a low-severity vulnerability affecting the Linux kernel.
How do I fix CVE-2025-39765?
To resolve CVE-2025-39765, you should update your Linux kernel to the latest version that includes the patch for this vulnerability.
What systems are affected by CVE-2025-39765?
CVE-2025-39765 affects systems running vulnerable versions of the Linux kernel that utilize the ALSA subsystem.
What does CVE-2025-39765 involve?
CVE-2025-39765 pertains to an improper handling of unallocated IDs within the ALSA timer functionality in the Linux kernel.
Is CVE-2025-39765 easy to exploit?
Exploitation of CVE-2025-39765 is considered to be difficult due to its reliance on specific conditions in the kernel's timer management.