CVE-2025-39930 (GCVE-0-2025-39930)

Vulnerability from cvelistv5 – Published: 2025-04-18 07:01 – Updated: 2026-08-05 12:06
VLAI
Title
ASoC: simple-card-utils: Don't use __free(device_node) at graph_util_parse_dai()
Summary
In the Linux kernel, the following vulnerability has been resolved: ASoC: simple-card-utils: Don't use __free(device_node) at graph_util_parse_dai() commit 419d1918105e ("ASoC: simple-card-utils: use __free(device_node) for device node") uses __free(device_node) for dlc->of_node, but we need to keep it while driver is in use. Don't use __free(device_node) in graph_util_parse_dai().
Severity
8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: e03f8d14191142849abad62307d4128afd304521 , < 146e25625378f7d4463acbd1ffbd975f3332a806 (git)
Affected: 142a386a805809e21361976d566392bcd07870b8 , < 16a49e3fda339aa552cde7f2cdbb25b91426cb8a (git)
Affected: 419d1918105e5d9926ab02f1f834bb416dc76f65 , < 232a32e8a7e9be8a2ee238df9b5304eed2f4e195 (git)
Affected: 419d1918105e5d9926ab02f1f834bb416dc76f65 , < de74ec718e0788e1998eb7289ad07970e27cae27 (git)
Affected: 6.6.130 , < 6.6.135 (semver)
Affected: 6.12.78 , < 6.12.82 (semver)
Create a notification for this product.
Linux Linux Affected: 6.14
Unaffected: 0 , < 6.14 (semver)
Unaffected: 6.6.135 , ≤ 6.6.* (semver)
Unaffected: 6.12.82 , ≤ 6.12.* (semver)
Unaffected: 6.14.2 , ≤ 6.14.* (semver)
Unaffected: 6.15 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/soc/generic/simple-card-utils.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "146e25625378f7d4463acbd1ffbd975f3332a806",
              "status": "affected",
              "version": "e03f8d14191142849abad62307d4128afd304521",
              "versionType": "git"
            },
            {
              "lessThan": "16a49e3fda339aa552cde7f2cdbb25b91426cb8a",
              "status": "affected",
              "version": "142a386a805809e21361976d566392bcd07870b8",
              "versionType": "git"
            },
            {
              "lessThan": "232a32e8a7e9be8a2ee238df9b5304eed2f4e195",
              "status": "affected",
              "version": "419d1918105e5d9926ab02f1f834bb416dc76f65",
              "versionType": "git"
            },
            {
              "lessThan": "de74ec718e0788e1998eb7289ad07970e27cae27",
              "status": "affected",
              "version": "419d1918105e5d9926ab02f1f834bb416dc76f65",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.135",
              "status": "affected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.82",
              "status": "affected",
              "version": "6.12.78",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/soc/generic/simple-card-utils.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.135",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.82",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.135",
                  "versionStartIncluding": "6.6.130",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.82",
                  "versionStartIncluding": "6.12.78",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.2",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: simple-card-utils: Don\u0027t use __free(device_node) at graph_util_parse_dai()\n\ncommit 419d1918105e (\"ASoC: simple-card-utils: use __free(device_node) for\ndevice node\") uses __free(device_node) for dlc-\u003eof_node, but we need to\nkeep it while driver is in use.\n\nDon\u0027t use __free(device_node) in graph_util_parse_dai()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is a device-tree platform driver reached only through the local driver model \u2014 probe/deferred-probe, sysfs bind/unbind of `asoc-audio-graph-card[2]`, or module unload; there is no network, adjacent-network, or physical-access path to `graph_util_parse_dai()`, and exploiting the resulting freed `device_node` requires a local heap spray (msgsnd/xattr/keyring) in the same kmalloc cache.\nAC:L - The lost reference is unconditional \u2014 every successful parse stores `dlc-\u003eof_node` while `__free(device_node)` drops the ref, and every `simple_util_clean_reference()` call issues a matching extra `of_node_put()`. There is no race to win and no memory-layout precondition; `snd_soc_get_dlc()` returning `-EPROBE_DEFER` makes the sequence repeat deterministically on each probe retry, and bind/unbind cycles reproduce it at will.\nPR:N - No credential, capability, or namespace check exists anywhere on the path \u2014 the refcount is dropped by the kernel\u0027s own deferred-probe machinery at boot, before any user session exists, so the freed/underflowed `device_node` state is reached with zero privileges. Deliberate re-triggering via sysfs unbind would need root, but that is not required for the vulnerable condition to arise.\nUI:N - The audio graph card probes automatically from the device tree at boot and the deferred-probe retries run unattended; no administrator or victim action, mount, or file open is needed for the extra `of_node_put()` to fire.\nS:U - The corrupted `device_node`, its kobject, and the OF tree all belong to the kernel\u0027s own security authority, and the faulting code runs in the same kernel context. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a premature release/use-after-free of a `struct device_node` that remains reachable through `dlc-\u003eof_node`, the OF tree, and the codec\u0027s `device-\u003eof_node`; once the slab is reclaimed, `of_property_read_*()`, `%pOF` formatting of `full_name`, and phandle lookups read back attacker-sprayed heap contents, and the pre-free splat already leaks kernel pointers and a full stack trace via `dump_stack()`.\nI:H - A reclaimed `device_node` yields a control-flow hijack primitive through the embedded `fwnode_handle.ops` table dereferenced by `fwnode_call_int_op()` and through `kobj.ktype-\u003erelease` invoked on the next `of_node_put()`, while the `suppliers`/`consumers` list heads and `parent`/`child`/`sibling` links give arbitrary-write via list manipulation during device-link and tree operations.\nA:H - The refcount underflow produces an `ERROR: detected bad of_node_put()` splat plus `dump_stack()`, then a `refcount_t: underflow; use-after-free` WARN \u2014 an outright panic under `panic_on_warn`, common on automotive and hardened production kernels. With `OF_DYNAMIC` overlay nodes the node is genuinely `kfree()`d while still attached to the live device tree, so the next traversal oopses and the audio card fails to bind."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:06:09.443Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/146e25625378f7d4463acbd1ffbd975f3332a806"
        },
        {
          "url": "https://git.kernel.org/stable/c/16a49e3fda339aa552cde7f2cdbb25b91426cb8a"
        },
        {
          "url": "https://git.kernel.org/stable/c/232a32e8a7e9be8a2ee238df9b5304eed2f4e195"
        },
        {
          "url": "https://git.kernel.org/stable/c/de74ec718e0788e1998eb7289ad07970e27cae27"
        }
      ],
      "title": "ASoC: simple-card-utils: Don\u0027t use __free(device_node) at graph_util_parse_dai()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39930",
    "datePublished": "2025-04-18T07:01:38.576Z",
    "dateReserved": "2025-04-16T07:20:57.147Z",
    "dateUpdated": "2026-08-05T12:06:09.443Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-39930",
      "date": "2026-08-11",
      "epss": "0.00242",
      "percentile": "0.15499"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-39930\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-04-18T07:15:44.460\",\"lastModified\":\"2026-07-30T06:23:58.083\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nASoC: simple-card-utils: Don\u0027t use __free(device_node) at graph_util_parse_dai()\\n\\ncommit 419d1918105e (\\\"ASoC: simple-card-utils: use __free(device_node) for\\ndevice node\\\") uses __free(device_node) for dlc-\u003eof_node, but we need to\\nkeep it while driver is in use.\\n\\nDon\u0027t use __free(device_node) in graph_util_parse_dai().\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ASoC: simple-card-utils: No usar __free(device_node) en el commit 419d1918105e de graph_util_parse_dai() (\\\"ASoC: simple-card-utils: usar __free(device_node) para el nodo de dispositivo\\\") usa __free(device_node) para dlc-\u0026gt;of_node, pero es necesario mantenerlo mientras se usa el controlador. No usar __free(device_node) en graph_util_parse_dai().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"sound/soc/generic/simple-card-utils.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"e03f8d14191142849abad62307d4128afd304521\",\"lessThan\":\"146e25625378f7d4463acbd1ffbd975f3332a806\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"142a386a805809e21361976d566392bcd07870b8\",\"lessThan\":\"16a49e3fda339aa552cde7f2cdbb25b91426cb8a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"419d1918105e5d9926ab02f1f834bb416dc76f65\",\"lessThan\":\"232a32e8a7e9be8a2ee238df9b5304eed2f4e195\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"419d1918105e5d9926ab02f1f834bb416dc76f65\",\"lessThan\":\"de74ec718e0788e1998eb7289ad07970e27cae27\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.6.130\",\"lessThan\":\"6.6.135\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.12.78\",\"lessThan\":\"6.12.82\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"sound/soc/generic/simple-card-utils.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.135\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.82\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14.2\",\"lessThanOrEqual\":\"6.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.4,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.5,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.14\",\"versionEndExcluding\":\"6.14.2\",\"matchCriteriaId\":\"FADAE5D8-4808-442C-B218-77B2CE8780A0\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/146e25625378f7d4463acbd1ffbd975f3332a806\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/16a49e3fda339aa552cde7f2cdbb25b91426cb8a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/232a32e8a7e9be8a2ee238df9b5304eed2f4e195\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/de74ec718e0788e1998eb7289ad07970e27cae27\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:34:00+00:00",
      "cve": "CVE-2025-39930",
      "id": "CVE-2025-39930",
      "initial_release_date": "2025-04-18T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ASoC: simple-card-utils: Don\u0027t use __free(device_node) at graph_util_parse_dai()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-39930.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-07-19T17:47:32Z",
      "cve": "CVE-2025-39930",
      "id": "CVE-2025-39930",
      "initial_release_date": "2025-04-18T23:18:56Z",
      "product_status:known_not_affected": "346",
      "product_status:recommended": "27",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-39930",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-39930.json",
      "version": "10"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.