CVE-2025-38438

What it actually does

Memory leak in snd_sof_intel_hda_generic driver where sof_pdata->tplg_filename allocated via kstrdup() can be overwritten without release, leaving unreferenced objects as shown in kmemleak traces during hda_machine_select and sof_probe paths.

Why it matters to the business

Gradual memory exhaustion on Linux systems using Intel HDA audio with SOF, increasing risk of degraded performance or instability over time in servers, desktops, or embedded devices; low immediate urgency given age and low EPSS but still requires patching for long-term stability.

How an attack unfolds

An attacker with local access or ability to trigger repeated audio device initialization (via module load/unload or probe sequences) can cause repeated allocations of tplg_filename strings without corresponding frees, leading to memory depletion; no named threat actors or ransomware usage reported.

How to fix it

Upgrade affected Linux kernel packages to fixed versions: Debian 13 to 6.12.41-1 or later, Debian 14 to 6.16.3-1 or later, or mainline stable to commit 432c5363cd6fe5a928bbc94524d28b05515684dd or equivalent; rebuild and reboot after update.

How to confirm the fix worked

Confirm kernel version matches or exceeds the listed fixed releases; re-run kmemleak scan after audio driver load to verify no further leaks of sof-hda-generic strings; monitor /proc/meminfo and slabinfo for unexpected growth in kmalloc-16 objects.

Typical attack path

1. Trigger SOF Intel HDA driver probe or environment initialization
2. Cause hda_machine_select to allocate tplg_filename via kstrdup
3. Overwrite the pointer with a new allocation without freeing prior memory
4. Repeat to accumulate unreferenced allocations until memory pressure occurs

How to detect it

Search kernel logs and kmemleak reports for unreferenced allocations originating from kstrdup in hda_machine_select or snd_sof_intel_hda_generic; monitor for repeated sof_init_environment or sof_probe_work activity without corresponding frees; no specific runtime IOCs for active exploitation.

What your security team should do

• Prioritize kernel upgrades on all Debian 13/14 and custom builds using affected git trees within standard maintenance windows
• Enable kmemleak or similar memory debugging in test environments to validate absence of the leak post-patch
• Review audio subsystem usage in production workloads for any repeated probe patterns that could amplify impact