CVE-2025-39930: ASoC: simple-card-utils: Don't use __free(device_node) at graph_util_parse_dai()
In the Linux kernel, the following vulnerability has been resolved:
ASoC: simple-card-utils: Don't use free(devicenode) at graphutilparsedai()
commit 419d1918105e ("ASoC: simple-card-utils: use free(devicenode) for device node") uses free(devicenode) for dlc->ofnode, but we need to keep it while driver is in use.
Don't use free(devicenode) in graphutilparsedai().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Remove/modify the code in graph_util_parse_dai() so it does not use __free(device_node) for dlc->of_node, because dlc->of_node must be kept while the driver is in use.
Linux kernel (ASoC simple-card-utils) graph_util_parse_dai(): memory management of device_node = Do not call __free(device_node) in graph_util_parse_dai() (keep dlc->of_node while the driver is in use).
Event History
Frequently Asked Questions
What is the severity of CVE-2025-39930?
CVE-2025-39930 is classified as a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2025-39930?
To fix CVE-2025-39930, users should update their Linux kernel to the latest version where the vulnerability is patched.
What components are affected by CVE-2025-39930?
CVE-2025-39930 affects the ASoC: simple-card-utils component in the Linux kernel.
What are the potential impacts of CVE-2025-39930?
The potential impacts of CVE-2025-39930 may include memory management issues in the affected component.
When was CVE-2025-39930 reported?
CVE-2025-39930 was reported following the commit that addressed the use of __free(device_node) in the Linux kernel.