CVE-2025-39696 (GCVE-0-2025-39696)

Vulnerability from cvelistv5 – Published: 2025-09-05 17:21 – Updated: 2026-08-05 12:04
VLAI
Title
ALSA: hda: tas2781: Fix wrong reference of tasdevice_priv
Summary
In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: tas2781: Fix wrong reference of tasdevice_priv During the conversion to unify the calibration data management, the reference to tasdevice_priv was wrongly set to h->hda_priv instead of h->priv. This resulted in memory corruption and crashes eventually. Unfortunately it's a void pointer, hence the compiler couldn't know that it's wrong.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4fe238513407d83f38bf5782e8bcdd7b8baeb85d , < 2812815aa79637d39d4398ecd7e58f65d1c79231 (git)
Affected: 4fe238513407d83f38bf5782e8bcdd7b8baeb85d , < 3f4422e7c9436abf81a00270be7e4d6d3760ec0e (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.16
Unaffected: 0 , < 6.16 (semver)
Unaffected: 6.16.4 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/hda/codecs/side-codecs/tas2781_hda_i2c.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2812815aa79637d39d4398ecd7e58f65d1c79231",
              "status": "affected",
              "version": "4fe238513407d83f38bf5782e8bcdd7b8baeb85d",
              "versionType": "git"
            },
            {
              "lessThan": "3f4422e7c9436abf81a00270be7e4d6d3760ec0e",
              "status": "affected",
              "version": "4fe238513407d83f38bf5782e8bcdd7b8baeb85d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/hda/codecs/side-codecs/tas2781_hda_i2c.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.4",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: hda: tas2781: Fix wrong reference of tasdevice_priv\n\nDuring the conversion to unify the calibration data management, the\nreference to tasdevice_priv was wrongly set to h-\u003ehda_priv instead of\nh-\u003epriv.  This resulted in memory corruption and crashes eventually.\nUnfortunately it\u0027s a void pointer, hence the compiler couldn\u0027t know\nthat it\u0027s wrong."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The corruption occurs in the tas2781 HDA I2C codec driver\u0027s firmware-ready callback during local driver bind; there is no network, adjacent-network, or peer-supplied data path into `tas2563_save_calibration()`. Exploiting the resulting kernel heap corruption requires local presence on the affected machine.\nAC:L - The wrong pointer is dereferenced unconditionally every time `tasdev_fw_ready()` runs on a TAS2563 (ACPI HID INT8866) system \u2014 no race, no timing window, and no memory-layout precondition the attacker cannot influence. The driver is enabled in stock distro kernels and the hardware is common in consumer Lenovo laptops, so this is not a rare-config case.\nPR:L - No capability, credential, or privilege check exists anywhere on the path \u2014 the corruption fires from a kernel firmware-load worker at boot, before any authentication. A plain unprivileged local account on the affected system is sufficient to be positioned to leverage the resulting heap damage, so Low rather than High.\nUI:N - The vulnerable code is reached automatically from the asynchronous `request_firmware_nowait()` completion callback during device probe/bind; no victim must log in, mount anything, open a device node, or take any other action.\nS:U - The type confusion corrupts kernel heap memory belonging to the same kernel that hosts the vulnerable driver, with no crossing of a VM, IOMMU, or sandbox boundary. Impact and vulnerable component share one security authority.\nC:H - The function performs OOB reads of `p-\u003edev` and `p-\u003endev` hundreds/thousands of bytes past a 24-byte allocation and writes a live kernel heap pointer (`cd-\u003edata`) into an unrelated adjacent object, which can surface kernel addresses to userspace and defeat KASLR. Heap corruption of this kind is leverageable into broader memory disclosure.\nI:H - This is an out-of-bounds write: `cali_dat_sz_per_dev`, `total_sz`, `data`, and the five `cali_reg` fields are written ~790\u2013810 bytes beyond the object, and `devm_kzalloc()` performs a list insertion through an uncontrolled `struct device *`, giving a write through a wild pointer. OOB write plus type confusion is High integrity impact under the standard treatment.\nA:H - The maintainer explicitly states this \"resulted in memory corruption and crashes eventually\"; dereferencing the garbage `p-\u003edev` inside `devm_kzalloc()` (spinlock acquisition and list_add at an arbitrary address) reliably produces an oops or panic, and the corrupted neighbouring heap objects cause later crashes. Any kernel crash is High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:04:37.787Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2812815aa79637d39d4398ecd7e58f65d1c79231"
        },
        {
          "url": "https://git.kernel.org/stable/c/3f4422e7c9436abf81a00270be7e4d6d3760ec0e"
        }
      ],
      "title": "ALSA: hda: tas2781: Fix wrong reference of tasdevice_priv",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39696",
    "datePublished": "2025-09-05T17:21:02.068Z",
    "dateReserved": "2025-04-16T07:20:57.114Z",
    "dateUpdated": "2026-08-05T12:04:37.787Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-39696",
      "date": "2026-09-27",
      "epss": "0.00147",
      "percentile": "0.03335"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "sound/hda/codecs/side-codecs/tas2781_hda_i2c.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "2812815aa79637d39d4398ecd7e58f65d1c79231",
                    "status": "affected",
                    "version": "4fe238513407d83f38bf5782e8bcdd7b8baeb85d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3f4422e7c9436abf81a00270be7e4d6d3760ec0e",
                    "status": "affected",
                    "version": "4fe238513407d83f38bf5782e8bcdd7b8baeb85d",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "sound/hda/codecs/side-codecs/tas2781_hda_i2c.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.16"
                  },
                  {
                    "lessThan": "6.16",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.16.*",
                    "status": "unaffected",
                    "version": "6.16.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.17",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "26A22BE8-0D22-4155-AED4-BB823BB934AB",
                    "versionEndExcluding": "6.16.4",
                    "versionStartIncluding": "6.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "327D22EF-390B-454C-BD31-2ED23C998A1C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "C730CD9A-D969-4A8E-9522-162AAF7C0EE9",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: hda: tas2781: Fix wrong reference of tasdevice_priv\n\nDuring the conversion to unify the calibration data management, the\nreference to tasdevice_priv was wrongly set to h-\u003ehda_priv instead of\nh-\u003epriv.  This resulted in memory corruption and crashes eventually.\nUnfortunately it\u0027s a void pointer, hence the compiler couldn\u0027t know\nthat it\u0027s wrong."
          }
        ],
        "id": "CVE-2025-39696",
        "lastModified": "2026-07-30T06:23:40.747",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-09-05T18:15:46.503",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2812815aa79637d39d4398ecd7e58f65d1c79231"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/3f4422e7c9436abf81a00270be7e4d6d3760ec0e"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-Other"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:22:28+00:00",
      "cve": "CVE-2025-39696",
      "id": "CVE-2025-39696",
      "initial_release_date": "2025-09-05T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ALSA: hda: tas2781: Fix wrong reference of tasdevice_priv",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-39696.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T01:17:26Z",
      "cve": "CVE-2025-39696",
      "id": "CVE-2025-39696",
      "initial_release_date": "2025-09-05T23:23:09Z",
      "product_status:known_not_affected": "523",
      "product_status:recommended": "27",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-39696",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-39696.json",
      "version": "13"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.