01 Record

CVE-2025-38078

ALSA: pcm: Fix race of buffer access at PCM OSS layer

HighPUBLISHEDCNA: Linux

CNA base score7.8 CVSS v3.xCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

View raw JSON

02 Description

ALSA: pcm: Fix race of buffer access at PCM OSS layer

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 0.13% probability of exploitation activity in the next 30 days.
EPSS percentile: Ranks above 3.3% of scored records. A rank, not a probability.
NVD base score: 4.7 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD analysis status: Modified. NVD last modified this record on 2026-07-30.
Red Hat severity: Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2025-06-18 09:33Z1 YR AGO

Last updated

2026-08-05 11:59Z1 MO AGO

Reserved

2025-04-16

Assigning CNA

Linux

Record state

PUBLISHED

Severity

High (CVSS 7.8)

CNA CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')Class
CWE-366Race Condition within a ThreadBase

Data version

5.2

Document digest

4a842a9ffd7f2fea6c97694862a301b1c563ca9ee7606cc67a60e2ca1247cafd

05 Affected products

VendorProductVersionsPlatforms

LinuxLinux1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < c0e05a76fc727929524ef24a19c302e6dd40233f, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 8170d8ec4efd0be352c14cb61f374e30fb0c2a25, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 10217da9644ae75cea7330f902c35fc5ba78bbbf, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < f3e14d706ec18faf19f5a6e75060e140fea05d4a, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 74d90875f3d43f3eff0e9861c4701418795d3455, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < bf85e49aaf3a3c5775ea87369ea5f159c2148db4, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < afa56c960fcb4db37f2e3399f28e9402e4e1f470, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 93a81ca0657758b607c3f4ba889ae806be9beb73, 2.6.12—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/c0e05a76fc727929524ef24a19c302e6dd40233f
git.kernel.orghttps://git.kernel.org/stable/c/8170d8ec4efd0be352c14cb61f374e30fb0c2a25
git.kernel.orghttps://git.kernel.org/stable/c/10217da9644ae75cea7330f902c35fc5ba78bbbf
git.kernel.orghttps://git.kernel.org/stable/c/f3e14d706ec18faf19f5a6e75060e140fea05d4a
git.kernel.orghttps://git.kernel.org/stable/c/74d90875f3d43f3eff0e9861c4701418795d3455
git.kernel.orghttps://git.kernel.org/stable/c/bf85e49aaf3a3c5775ea87369ea5f159c2148db4
git.kernel.orghttps://git.kernel.org/stable/c/afa56c960fcb4db37f2e3399f28e9402e4e1f470
git.kernel.orghttps://git.kernel.org/stable/c/93a81ca0657758b607c3f4ba889ae806be9beb73
lists.debian.orghttps://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
lists.debian.orghttps://lists.debian.org/debian-lts-announce/2025/10/msg00007.html

01 Record index

CVE-2025-38078

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References

02 Records

CVE-2025-38078

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References