CVE-2025-38105

What it actually does

Active timer remains after snd_usbmidi_free releases its object due to missing or incorrect shutdown in removal paths, producing use-after-free conditions visible as kernel warnings under debug builds.

Why it matters to the business

Systems using USB MIDI audio devices may experience kernel instability or crashes during device removal or driver unload, affecting audio functionality on Linux hosts; low exploitability and no known ransomware use reduce urgency but still require patching of affected kernels.

How an attack unfolds

An attacker with local access triggers the rare removal sequence that bypasses the disconnect callback, leaving the timer armed; when the freed object is later accessed by the timer callback a kernel warning or crash occurs. No public exploit code or named threat actor activity is associated with this specific flaw.

How to fix it

Update to a kernel containing commit 647410a7da46067953a53c0d03f8680eff570959 or later; apply the equivalent fix that calls timer_shutdown_sync inside snd_usbmidi_free and replaces timer_delete_sync with timer_shutdown_sync in the disconnect callback. Reboot after kernel update.

How to confirm the fix worked

Confirm the presence of timer_shutdown_sync calls in snd_usbmidi_free and the disconnect handler in the usb-midi source; verify the fixed commit hash in the running kernel source or package; test USB MIDI device insertion/removal under debug kernel configuration and confirm absence of timer-related warnings.

Typical attack path

1. Obtain local access on a Linux system with USB-audio MIDI support
2. Insert and remove a USB MIDI device in a manner that skips the normal disconnect path
3. Trigger snd_usbmidi_free while the timer remains active
4. Observe kernel warning or potential crash when the timer fires against the released object

How to detect it

Review kernel logs for timer-related warnings emitted from usb-midi code paths during device removal; examine crash dumps or ftrace output for references to snd_usbmidi_free while a timer is still active.

What your security team should do

• Prioritize kernel updates on systems that expose USB audio/MIDI devices
• Monitor for future CVEs in the same ALSA usb-audio timer handling code
• Apply the update within normal patch windows given the low EPSS and lack of KEV listing