Answer in brief
CVE-2025-38105 records a Unknown severity vulnerability in ALSA: usb-audio: Kill timer properly at removal. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/SIMATIC S7-1500 TM MFP - GNU/Linux subsystem (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/SIMATIC S7-1500 TM MFP - GNU/Linux subsystem (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=c88469704d63787e8d44ca5ea1c1bd0adc29572d <06513dd6d32c37d0364db8488cfdf3e14da238a8 || >=c88469704d63787e8d44ca5ea1c1bd0adc29572d <efaf61052b8ff9ee8968912fbaf02c2847c78ede || >=c88469704d63787e8d44ca5ea1c1bd0adc29572d <647410a7da46067953a53c0d03f8680eff570959 || >=c88469704d63787e8d44ca5ea1c1bd0adc29572d <c611b9e55174e439dcd85a72969b43a95f3827a4 || >=c88469704d63787e8d44ca5ea1c1bd0adc29572d <62066758d2ae169278e5d6aea5995b1b6f6ddeb5 || >=c88469704d63787e8d44ca5ea1c1bd0adc29572d <0718a78f6a9f04b88d0dc9616cc216b31c5f3cf1 | 06513dd6d32c37d0364db8488cfdf3e14da238a8, efaf61052b8ff9ee8968912fbaf02c2847c78ede, 647410a7da46067953a53c0d03f8680eff570959, c611b9e55174e439dcd85a72969b43a95f3827a4, 62066758d2ae169278e5d6aea5995b1b6f6ddeb5, 0718a78f6a9f04b88d0dc9616cc216b31c5f3cf1 |
| Linux/Linuxgeneric | 2.6.14 | Not reported |
| Siemens/SIMATIC S7-1500 TM MFP - GNU/Linux subsystemgeneric | >=0 <* | * |
Published upstream
Jul 3, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 15, 2026
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Kill timer properly at removal The USB-audio MIDI code initializes the timer, but in a rare case, the driver might be freed without the disconnect call. This leaves the timer in an active state while the assigned object is released via snd_usbmidi_free(), which ends up with a kernel warning when the debug configuration is enabled, as spotted by fuzzer. For avoiding the problem, put timer_shutdown_sync() at snd_usbmidi_free(), so that the timer can be killed properly. While we're at it, replace the existing timer_delete_sync() at the disconnect callback with timer_shutdown_sync(), too.
Quoted source text, attributed separately from HOL analysis.