U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

National Vulnerability Database

National Vulnerability Database

NVD

National Vulnerability Database
  1. Vulnerabilities

CVE-2025-38078 Detail

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Fix race of buffer access at PCM OSS layer The PCM OSS layer tries to clear the buffer with the silence data at initialization (or reconfiguration) of a stream with the explicit call of snd_pcm_format_set_silence() with runtime->dma_area. But this may lead to a UAF because the accessed runtime->dma_area might be freed concurrently, as it's performed outside the PCM ops. For avoiding it, move the code into the PCM core and perform it inside the buffer access lock, so that it won't be changed during the operation.


Metrics

 
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 4.0 Severity and Vector Strings:

NIST CVSS score
NIST: NVD
N/A
NVD assessment not yet provided.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

URL Source(s) Tag(s)
https://git.kernel.org/stable/c/10217da9644ae75cea7330f902c35fc5ba78bbbf kernel.org
https://git.kernel.org/stable/c/74d90875f3d43f3eff0e9861c4701418795d3455 kernel.org
https://git.kernel.org/stable/c/8170d8ec4efd0be352c14cb61f374e30fb0c2a25 kernel.org
https://git.kernel.org/stable/c/93a81ca0657758b607c3f4ba889ae806be9beb73 kernel.org
https://git.kernel.org/stable/c/afa56c960fcb4db37f2e3399f28e9402e4e1f470 kernel.org
https://git.kernel.org/stable/c/bf85e49aaf3a3c5775ea87369ea5f159c2148db4 kernel.org
https://git.kernel.org/stable/c/c0e05a76fc727929524ef24a19c302e6dd40233f kernel.org
https://git.kernel.org/stable/c/f3e14d706ec18faf19f5a6e75060e140fea05d4a kernel.org

Weakness Enumeration

CWE-ID CWE Name Source

Change History

1 change records found show changes

Quick Info

CVE Dictionary Entry:
CVE-2025-38078
NVD Published Date:
06/18/2025
NVD Last Modified:
06/18/2025
Source:
kernel.org