CVE-2025-38056: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38056 is a use-after-free (UAF) vulnerability in the Linux kernel's ASoC (Advanced Sound Architecture) SOF (Sound Open Firmware) Intel HDA (High Definition Audio) module. The flaw is triggered when the snd_sof_intel_hda_generic module is reloaded: hda_generic_machine_select() allocates a new string via devm_kasprintf() and stores it back into the global variable snd_soc_acpi_intel_hda_machines, which then points to freed memory after module unload. Affected kernel versions include 6.12.x before 6.12.31, 6.13.x through 6.14.x before 6.14.9, and release candidates 6.15-rc1 through 6.15-rc7. It was published on June 18, 2025, and carries a CVSS v3.1 base score of 7.8 (High) (Feedly, Ubuntu Advisory).

The root cause is classified as CWE-416 (Use After Free). In hda_generic_machine_select(), a new string with an -idisp suffix is allocated using devm_kasprintf() — a device-managed allocator — and written back into the global snd_soc_acpi_intel_hda_machines table. When the module is unloaded, the device-managed memory is freed, but the global pointer is not reset. Upon module reload, the kernel attempts to read the stale pointer, triggering a KFENCE-detected use-after-free in the string() → vsnprintf() → devm_kvasprintf() call chain within hda_machine_select.cold. The attack vector is local, requires low privileges, and no user interaction (Feedly). Patches are available at the upstream kernel stable tree (Kernel Patch 1, Kernel Patch 2, Kernel Patch 3).

Successful exploitation could allow a local attacker with low privileges to read sensitive kernel memory contents, potentially execute arbitrary code in kernel context, or cause system instability and kernel crashes (denial of service). The vulnerability affects the confidentiality, integrity, and availability of the system, as the freed memory region could be reallocated and overwritten before the stale pointer is dereferenced, enabling controlled memory corruption. Systems using Intel HDA audio hardware with the SOF firmware stack and subject to module reloading are at risk (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.017%, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and the ability to trigger module unload/reload cycles, which limits the practical attack surface.

The primary remediation is to update to a patched Linux kernel version: 6.12.31 or later for the 6.12 stable branch, and 6.14.9 or later for the 6.13/6.14 branch (Feedly). Ubuntu has issued security notices USN-7699-1 and USN-7699-2 addressing this vulnerability (Ubuntu Advisory, Ubuntu HWE Advisory). As a short-term workaround, avoid unnecessary reloading of the snd_sof_intel_hda_generic kernel module, and consider using kernel security modules such as SELinux or AppArmor to restrict module loading privileges for unprivileged users.