PT-2025-27691 · Linux+4 · Linux Kernel+4
Published
2025-05-19
·
Updated
2026-05-07
·
CVE-2025-38105
CVSS v2.0
6.0
Medium
| Vector | AV:L/AC:H/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions:
Linux kernel (affected versions not specified)
Description:
A vulnerability in the Linux kernel's USB-audio MIDI code has been identified. The issue arises when the driver is freed without the disconnect call, leaving a timer in an active state. This results in a kernel warning when the debug configuration is enabled. The problem occurs due to the improper initialization of the timer.
Recommendations:
For the Linux kernel, to resolve the issue, put
timer shutdown sync() at snd usbmidi free(), so that the timer can be killed properly. Additionally, replace the existing timer delete sync() at the disconnect callback with timer shutdown sync().Exploit
Fix
Improper Initialization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Debian
Linuxmint
Linux Kernel
Suse
Ubuntu