CVE-2025-39765

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: timer: fix ida_free call while not allocated

In the snd_utimer_create() function, if the kasprintf() function return

NULL, snd_utimer_put_id() will be called, finally use ida_free()

to free the unallocated id 0.

the syzkaller reported the following information:

------------[ cut here ]------------

ida_free called for id=0 which is not allocated.

WARNING: CPU: 1 PID: 1286 at lib/idr.c:592 ida_free+0x1fd/0x2f0 lib/idr.c:592

Modules linked in:

CPU: 1 UID: 0 PID: 1286 Comm: syz-executor164 Not tainted 6.15.8 #3 PREEMPT(lazy)

Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-4.fc42 04/01/2014

RIP: 0010:ida_free+0x1fd/0x2f0 lib/idr.c:592

Code: f8 fc 41 83 fc 3e 76 69 e8 70 b2 f8 (...)

RSP: 0018:ffffc900007f79c8 EFLAGS: 00010282

RAX: 0000000000000000 RBX: 1ffff920000fef3b RCX: ffffffff872176a5

RDX: ffff88800369d200 RSI: 0000000000000000 RDI: ffff88800369d200

RBP: 0000000000000

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References