CVE-2025-38056: 
Linux Kernel vulnerability analysis and mitigation

In the Linux kernel, a use-after-free vulnerability was discovered in the ASoC SOF Intel HDA component. The issue occurs when hda_generic_machine_select() appends -idisp to the tplg filename by allocating a new string with devm_kasprintf() and storing it in the global variable snd_soc_acpi_intel_hda_machines. The vulnerability was disclosed on June 18, 2025 (NVD).

The vulnerability is triggered when reloading the module, which causes a use-after-free read condition in the string+0x48/0xe0 function. When the module is unloaded, the memory is freed, resulting in a global variable pointing to freed memory. The bug was detected by KFENCE (Kernel Electric-Fence) showing the memory was allocated by task 333 on cpu 8 and later freed by task 1543 on cpu 4 (NVD, Wiz).

This use-after-free vulnerability could lead to memory corruption in the Linux kernel. When exploited, it could potentially result in system crashes, information leaks, or possible privilege escalation in the context of the kernel (Wiz).

The vulnerability has been patched by modifying the code to copy the match array with devm_kmemdup_array() before any modifications are made. Users should update their Linux kernel to a version containing this fix (Wiz).