Memory Management Vulnerability in Linux Kernel Affecting ALSA Timers

CVE-2025-39765

What is CVE-2025-39765?

A vulnerability in the Linux kernel's ALSA timer functionality allows for improper handling of ID allocations. Specifically, the snd_utimer_create() function can lead to a scenario where the ida_free() function is erroneously invoked to free an unallocated ID. This could potentially lead to resource management issues and impact system stability. To mitigate this issue, the ID should be set correctly before calling kasprintf(), ensuring that snd_utimer_put_id() only frees allocated IDs.

References