{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-39930", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.147Z", "datePublished": "2025-04-18T07:01:38.576Z", "dateUpdated": "2026-08-05T12:06:09.443Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:06:09.443Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: simple-card-utils: Don't use __free(device_node) at graph_util_parse_dai()\n\ncommit 419d1918105e (\"ASoC: simple-card-utils: use __free(device_node) for\ndevice node\") uses __free(device_node) for dlc->of_node, but we need to\nkeep it while driver is in use.\n\nDon't use __free(device_node) in graph_util_parse_dai()." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable code is a device-tree platform driver reached only through the local driver model — probe/deferred-probe, sysfs bind/unbind of `asoc-audio-graph-card[2]`, or module unload; there is no network, adjacent-network, or physical-access path to `graph_util_parse_dai()`, and exploiting the resulting freed `device_node` requires a local heap spray (msgsnd/xattr/keyring) in the same kmalloc cache.\nAC:L - The lost reference is unconditional — every successful parse stores `dlc->of_node` while `__free(device_node)` drops the ref, and every `simple_util_clean_reference()` call issues a matching extra `of_node_put()`. There is no race to win and no memory-layout precondition; `snd_soc_get_dlc()` returning `-EPROBE_DEFER` makes the sequence repeat deterministically on each probe retry, and bind/unbind cycles reproduce it at will.\nPR:N - No credential, capability, or namespace check exists anywhere on the path — the refcount is dropped by the kernel's own deferred-probe machinery at boot, before any user session exists, so the freed/underflowed `device_node` state is reached with zero privileges. Deliberate re-triggering via sysfs unbind would need root, but that is not required for the vulnerable condition to arise.\nUI:N - The audio graph card probes automatically from the device tree at boot and the deferred-probe retries run unattended; no administrator or victim action, mount, or file open is needed for the extra `of_node_put()` to fire.\nS:U - The corrupted `device_node`, its kobject, and the OF tree all belong to the kernel's own security authority, and the faulting code runs in the same kernel context. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a premature release/use-after-free of a `struct device_node` that remains reachable through `dlc->of_node`, the OF tree, and the codec's `device->of_node`; once the slab is reclaimed, `of_property_read_*()`, `%pOF` formatting of `full_name`, and phandle lookups read back attacker-sprayed heap contents, and the pre-free splat already leaks kernel pointers and a full stack trace via `dump_stack()`.\nI:H - A reclaimed `device_node` yields a control-flow hijack primitive through the embedded `fwnode_handle.ops` table dereferenced by `fwnode_call_int_op()` and through `kobj.ktype->release` invoked on the next `of_node_put()`, while the `suppliers`/`consumers` list heads and `parent`/`child`/`sibling` links give arbitrary-write via list manipulation during device-link and tree operations.\nA:H - The refcount underflow produces an `ERROR: detected bad of_node_put()` splat plus `dump_stack()`, then a `refcount_t: underflow; use-after-free` WARN — an outright panic under `panic_on_warn`, common on automotive and hardened production kernels. With `OF_DYNAMIC` overlay nodes the node is genuinely `kfree()`d while still attached to the live device tree, so the next traversal oopses and the audio card fails to bind." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "sound/soc/generic/simple-card-utils.c" ], "versions": [ { "version": "e03f8d14191142849abad62307d4128afd304521", "lessThan": "146e25625378f7d4463acbd1ffbd975f3332a806", "status": "affected", "versionType": "git" }, { "version": "142a386a805809e21361976d566392bcd07870b8", "lessThan": "16a49e3fda339aa552cde7f2cdbb25b91426cb8a", "status": "affected", "versionType": "git" }, { "version": "419d1918105e5d9926ab02f1f834bb416dc76f65", "lessThan": "232a32e8a7e9be8a2ee238df9b5304eed2f4e195", "status": "affected", "versionType": "git" }, { "version": "419d1918105e5d9926ab02f1f834bb416dc76f65", "lessThan": "de74ec718e0788e1998eb7289ad07970e27cae27", "status": "affected", "versionType": "git" }, { "version": "6.6.130", "lessThan": "6.6.135", "status": "affected", "versionType": "semver" }, { "version": "6.12.78", "lessThan": "6.12.82", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "sound/soc/generic/simple-card-utils.c" ], "versions": [ { "version": "6.14", "status": "affected" }, { "version": "0", "lessThan": "6.14", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.135", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.82", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.14.2", "lessThanOrEqual": "6.14.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.130", "versionEndExcluding": "6.6.135" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.78", "versionEndExcluding": "6.12.82" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "6.14.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "6.15" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/146e25625378f7d4463acbd1ffbd975f3332a806" }, { "url": "https://git.kernel.org/stable/c/16a49e3fda339aa552cde7f2cdbb25b91426cb8a" }, { "url": "https://git.kernel.org/stable/c/232a32e8a7e9be8a2ee238df9b5304eed2f4e195" }, { "url": "https://git.kernel.org/stable/c/de74ec718e0788e1998eb7289ad07970e27cae27" } ], "title": "ASoC: simple-card-utils: Don't use __free(device_node) at graph_util_parse_dai()", "x_generator": { "engine": "bippy-1.2.0" } } } }