CVE-2025-38056

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ASoC: SOF: Intel: hda: Fix UAF when reloading module

hda_generic_machine_select() appends -idisp to the tplg filename by

allocating a new string with devm_kasprintf(), then stores the string

right back into the global variable snd_soc_acpi_intel_hda_machines.

When the module is unloaded, this memory is freed, resulting in a global

variable pointing to freed memory. Reloading the module then triggers

a use-after-free:

BUG: KFENCE: use-after-free read in string+0x48/0xe0

Use-after-free read at 0x00000000967e0109 (in kfence-#99):

string+0x48/0xe0

vsnprintf+0x329/0x6e0

devm_kvasprintf+0x54/0xb0

devm_kasprintf+0x58/0x80

hda_machine_select.cold+0x198/0x17a2 [snd_sof_intel_hda_generic]

sof_probe_work+0x7f/0x600 [snd_sof]

process_one_work+0x17b/0x330

worker_thread+0x2ce/0x3f0

kthread+0xcf/0x100

ret_from_fork+0x31/0x50

ret_from_fork_asm+0x1a/0x30

kfence-#99: 0x00000000198a940f-0x00000000ace47d9d, size=64, cache

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References