CVE-2025-38438

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak.

sof_pdata->tplg_filename can have address allocated by kstrdup()

and can be overwritten. Memory leak was detected with kmemleak:

unreferenced object 0xffff88812391ff60 (size 16):

comm "kworker/4:1", pid 161, jiffies 4294802931

hex dump (first 16 bytes):

73 6f 66 2d 68 64 61 2d 67 65 6e 65 72 69 63 00 sof-hda-generic.

backtrace (crc 4bf1675c):

__kmalloc_node_track_caller_noprof+0x49c/0x6b0

kstrdup+0x46/0xc0

hda_machine_select.cold+0x1de/0x12cf [snd_sof_intel_hda_generic]

sof_init_environment+0x16f/0xb50 [snd_sof]

sof_probe_continue+0x45/0x7c0 [snd_sof]

sof_probe_work+0x1e/0x40 [snd_sof]

process_one_work+0x894/0x14b0

worker_thread+0x5e5/0xfb0

kthread+0x39d/0x760

ret_from_fork+0x31/0x70

ret_from_fork_asm+0x1a/0x30

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References