Memory Access Vulnerability in Linux Kernel Affecting ALSA PCM Layer

CVE-2025-38078

What is CVE-2025-38078?

A vulnerability in the ALSA PCM layer of the Linux kernel could lead to a use after free (UAF) condition due to concurrent access to runtime memory. Specifically, the PCM OSS layer attempted to clear buffers with silence data during stream initialization or reconfiguration. This operation, which requires access to the runtime's DMA area, may result in accessing freed memory if handled incorrectly. The fix involves relocating buffer access operations within a protected PCM core function, ensuring that the memory remains valid for the duration of the operation.

References