Cloudanix VulnDB

CVE-2025-39765

None

CVSS

—

EPSS

0.2%

Published

Sep 11, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux sound-system bug can generate warning messages or minor instability when creating timers if the system runs low on memory.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Other
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Incorrect error handling in ALSA timer code causes ida_free to be invoked on an unallocated ID 0 when kasprintf fails inside snd_utimer_create during user ioctl handling.

Why it matters to the business

May produce kernel warnings or minor instability on Linux audio subsystems under memory pressure; affects broad range of kernel-based systems with high ecosystem prevalence.

How an attack unfolds

Attacker issues crafted timer ioctl that forces kasprintf failure in snd_utimer_create, triggering snd_utimer_put_id to call ida_free on the never-allocated ID 0 and emit a warning.

How to fix it

Upgrade Linux kernel to commit 34327b362ce2849a5eb02f47e800049e7a20a0ba or later equivalent stable release.

How to confirm the fix worked

Confirm presence of the fix commit in kernel source; reproduce timer creation under memory pressure and verify absence of ida_free warning.

Typical attack path

  1. Open ALSA timer device
  2. Issue ioctl that reaches snd_utimer_create
  3. Induce memory allocation failure for kasprintf
  4. Trigger ida_free on unallocated ID

How to detect it

Search kernel logs and dmesg for the exact ida_free warning string referencing id=0 and lib/idr.c:592; correlate with processes invoking ALSA timer ioctls.

  • ida_free called for id=0 which is not allocated
  • WARNING: CPU:.* at lib/idr.c:592 ida_free+0x1fd/0x2f0
  • snd_utimer_create+0x59b/0x6a0 sound/core/timer.c

What your security team should do

  • Apply the referenced kernel commit or newer release immediately
  • Monitor dmesg and syslog for ida_free warnings
  • Limit unprivileged access to /dev/snd/timer where feasible

The record

In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: fix ida_free call while not allocated In the snd_utimer_create() function, if the kasprintf() function return NULL, snd_utimer_put_id() will be called, finally use ida_free() to free the unallocated id 0. the syzkaller reported the following information: ------------[ cut here ]------------ ida_free called for id=0 which is not allocated. WARNING: CPU: 1 PID: 1286 at lib/idr.c:592 ida_free+0x1fd/0x2f0 lib/idr.c:592 Modules linked in: CPU: 1 UID: 0 PID: 1286 Comm: syz-executor164 Not tainted 6.15.8 #3 PREEMPT(lazy) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-4.fc42 04/01/2014 RIP: 0010:ida_free+0x1fd/0x2f0 lib/idr.c:592 Code: f8 fc 41 83 fc 3e 76 69 e8 70 b2 f8 (...) RSP: 0018:ffffc900007f79c8 EFLAGS: 00010282 RAX: 0000000000000000 RBX: 1ffff920000fef3b RCX: ffffffff872176a5 RDX: ffff88800369d200 RSI: 0000000000000000 RDI: ffff88800369d200 RBP: 0000000000000000 R08: ffffffff87ba60a5 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000002 R14: 0000000000000000 R15: 0000000000000000 FS: 00007f6f1abc1740(0000) GS:ffff8880d76a0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f6f1ad7a784 CR3: 000000007a6e2000 CR4: 00000000000006f0 Call Trace: <TASK> snd_utimer_put_id sound/core/timer.c:2043 [inline] [snd_timer] snd_utimer_create+0x59b/0x6a0 sound/core/timer.c:2184 [snd_timer] snd_utimer_ioctl_create sound/core/timer.c:2202 [inline] [snd_timer] __snd_timer_user_ioctl.isra.0+0x724/0x1340 sound/core/timer.c:2287 [snd_timer] snd_timer_user_ioctl+0x75/0xc0 sound/core/timer.c:2298 [snd_timer] vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl fs/ioctl.c:893 [inline] __x64_sys_ioctl+0x198/0x200 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x7b/0x160 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e [...] The utimer->id should be set properly before the kasprintf() function, ensures the snd_utimer_put_id() function will free the allocated id.

Affected packages

Ecosystem Package Introduced Fixed
Debian:13 linux 0 No fix
Debian:14 linux 0 No fix
Debian:14 linux 0 6.16.5-1
Linux Kernel 6.12.0 6.12.44
openSUSE:Leap 16.0 dtb-aarch64 0 6.12.0-160000.6.1
openSUSE:Leap 16.0 kernel-64kb 0 6.12.0-160000.6.1
openSUSE:Leap 16.0 kernel-default 0 6.12.0-160000.6.1
openSUSE:Leap 16.0 kernel-default-base 0 6.12.0-160000.6.1.160000.2.4
openSUSE:Leap 16.0 kernel-docs 0 6.12.0-160000.6.1
openSUSE:Leap 16.0 kernel-kvmsmall 0 6.12.0-160000.6.1
openSUSE:Leap 16.0 kernel-obs-build 0 6.12.0-160000.6.1
openSUSE:Leap 16.0 kernel-obs-qa 0 6.12.0-160000.6.1
openSUSE:Leap 16.0 kernel-rt 0 6.12.0-160000.6.1
openSUSE:Leap 16.0 kernel-source 0 6.12.0-160000.6.1
openSUSE:Leap 16.0 kernel-syms 0 6.12.0-160000.6.1
openSUSE:Leap 16.0 kernel-zfcpdump 0 6.12.0-160000.6.1

Related vulnerabilities