CVE-2025-40338: ASoC: Intel: avs: Do not share the name pointer between components
In the Linux kernel, the following vulnerability has been resolved:
ASoC: Intel: avs: Do not share the name pointer between components
By sharing 'name' directly, tearing down components may lead to use-after-free errors. Duplicate the name to avoid that.
At the same time, update the order of operations - since commit cee28113db17 ("ASoC: dmaenginepcm: Allow passing component name via config") the framework does not override component->name if set before invoking the initializer.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch cee28113db17
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40338?
The severity of CVE-2025-40338 is assessed to be moderate due to the potential for use-after-free errors.
How do I fix CVE-2025-40338?
To fix CVE-2025-40338, update to the latest version of the Linux kernel where the vulnerability has been resolved.
What is the impact of CVE-2025-40338 on affected systems?
The impact of CVE-2025-40338 on affected systems includes potential system crashes or arbitrary code execution due to use-after-free conditions.
Which versions of the Linux kernel are affected by CVE-2025-40338?
CVE-2025-40338 affects specific versions of the Linux kernel where the name pointer sharing issue was present.
Is there a workaround for CVE-2025-40338 if an update cannot be applied?
Currently, no specific workaround is available for CVE-2025-40338 other than applying the patch provided in the kernel update.