CVE-2025-39930 (GCVE-0-2025-39930)
Vulnerability from cvelistv5
Published
2025-04-18 07:01
Modified
2026-08-05 12:06
Severity ?
8.4 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: ASoC: simple-card-utils: Don't use __free(device_node) at graph_util_parse_dai() commit 419d1918105e ("ASoC: simple-card-utils: use __free(device_node) for device node") uses __free(device_node) for dlc->of_node, but we need to keep it while driver is in use. Don't use __free(device_node) in graph_util_parse_dai().
References
Impacted products
Vendor Product Version
Linux Linux Version: e03f8d14191142849abad62307d4128afd304521
Version: 142a386a805809e21361976d566392bcd07870b8
Version: 419d1918105e5d9926ab02f1f834bb416dc76f65
Version: 419d1918105e5d9926ab02f1f834bb416dc76f65
Version: 6.6.130   ≤
Version: 6.12.78   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/soc/generic/simple-card-utils.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "146e25625378f7d4463acbd1ffbd975f3332a806",
              "status": "affected",
              "version": "e03f8d14191142849abad62307d4128afd304521",
              "versionType": "git"
            },
            {
              "lessThan": "16a49e3fda339aa552cde7f2cdbb25b91426cb8a",
              "status": "affected",
              "version": "142a386a805809e21361976d566392bcd07870b8",
              "versionType": "git"
            },
            {
              "lessThan": "232a32e8a7e9be8a2ee238df9b5304eed2f4e195",
              "status": "affected",
              "version": "419d1918105e5d9926ab02f1f834bb416dc76f65",
              "versionType": "git"
            },
            {
              "lessThan": "de74ec718e0788e1998eb7289ad07970e27cae27",
              "status": "affected",
              "version": "419d1918105e5d9926ab02f1f834bb416dc76f65",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.135",
              "status": "affected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.82",
              "status": "affected",
              "version": "6.12.78",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/soc/generic/simple-card-utils.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.135",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.82",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.135",
                  "versionStartIncluding": "6.6.130",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.82",
                  "versionStartIncluding": "6.12.78",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.2",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: simple-card-utils: Don\u0027t use __free(device_node) at graph_util_parse_dai()\n\ncommit 419d1918105e (\"ASoC: simple-card-utils: use __free(device_node) for\ndevice node\") uses __free(device_node) for dlc-\u003eof_node, but we need to\nkeep it while driver is in use.\n\nDon\u0027t use __free(device_node) in graph_util_parse_dai()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is a device-tree platform driver reached only through the local driver model \u2014 probe/deferred-probe, sysfs bind/unbind of `asoc-audio-graph-card[2]`, or module unload; there is no network, adjacent-network, or physical-access path to `graph_util_parse_dai()`, and exploiting the resulting freed `device_node` requires a local heap spray (msgsnd/xattr/keyring) in the same kmalloc cache.\nAC:L - The lost reference is unconditional \u2014 every successful parse stores `dlc-\u003eof_node` while `__free(device_node)` drops the ref, and every `simple_util_clean_reference()` call issues a matching extra `of_node_put()`. There is no race to win and no memory-layout precondition; `snd_soc_get_dlc()` returning `-EPROBE_DEFER` makes the sequence repeat deterministically on each probe retry, and bind/unbind cycles reproduce it at will.\nPR:N - No credential, capability, or namespace check exists anywhere on the path \u2014 the refcount is dropped by the kernel\u0027s own deferred-probe machinery at boot, before any user session exists, so the freed/underflowed `device_node` state is reached with zero privileges. Deliberate re-triggering via sysfs unbind would need root, but that is not required for the vulnerable condition to arise.\nUI:N - The audio graph card probes automatically from the device tree at boot and the deferred-probe retries run unattended; no administrator or victim action, mount, or file open is needed for the extra `of_node_put()` to fire.\nS:U - The corrupted `device_node`, its kobject, and the OF tree all belong to the kernel\u0027s own security authority, and the faulting code runs in the same kernel context. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a premature release/use-after-free of a `struct device_node` that remains reachable through `dlc-\u003eof_node`, the OF tree, and the codec\u0027s `device-\u003eof_node`; once the slab is reclaimed, `of_property_read_*()`, `%pOF` formatting of `full_name`, and phandle lookups read back attacker-sprayed heap contents, and the pre-free splat already leaks kernel pointers and a full stack trace via `dump_stack()`.\nI:H - A reclaimed `device_node` yields a control-flow hijack primitive through the embedded `fwnode_handle.ops` table dereferenced by `fwnode_call_int_op()` and through `kobj.ktype-\u003erelease` invoked on the next `of_node_put()`, while the `suppliers`/`consumers` list heads and `parent`/`child`/`sibling` links give arbitrary-write via list manipulation during device-link and tree operations.\nA:H - The refcount underflow produces an `ERROR: detected bad of_node_put()` splat plus `dump_stack()`, then a `refcount_t: underflow; use-after-free` WARN \u2014 an outright panic under `panic_on_warn`, common on automotive and hardened production kernels. With `OF_DYNAMIC` overlay nodes the node is genuinely `kfree()`d while still attached to the live device tree, so the next traversal oopses and the audio card fails to bind."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:06:09.443Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/146e25625378f7d4463acbd1ffbd975f3332a806"
        },
        {
          "url": "https://git.kernel.org/stable/c/16a49e3fda339aa552cde7f2cdbb25b91426cb8a"
        },
        {
          "url": "https://git.kernel.org/stable/c/232a32e8a7e9be8a2ee238df9b5304eed2f4e195"
        },
        {
          "url": "https://git.kernel.org/stable/c/de74ec718e0788e1998eb7289ad07970e27cae27"
        }
      ],
      "title": "ASoC: simple-card-utils: Don\u0027t use __free(device_node) at graph_util_parse_dai()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39930",
    "datePublished": "2025-04-18T07:01:38.576Z",
    "dateReserved": "2025-04-16T07:20:57.147Z",
    "dateUpdated": "2026-08-05T12:06:09.443Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.