CVE-2025-40338

Vulnerability

The vulnerability is a use-after-free in the Intel ASoC avs driver. The root cause is that the driver shares the 'name' pointer between components without duplication. When tearing down components, this shared pointer can become invalid, leading to use-after-free errors [1].

Exploitation

An attacker would need to trigger component removal, typically through a crafted audio configuration or device removal. Exploitation does not require authentication if the attacker can interact with the audio subsystem from user space [1].

Impact

An attacker exploiting this could cause a kernel crash (denial of service) or potentially execute arbitrary code in kernel context, leading to privilege escalation [1].

Mitigation

The fix duplicates the name pointer to avoid use-after-free. Additionally, the order of operations was updated to prevent the framework from overriding the component name [1]. The patch is available in the stable kernel tree [1].