Linux Kernel
CVE-2025-38438
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocal authenticated access to SOF audio host
-
ExploitTrigger SOF driver probe/machine-select
-
Executiontplg_filename overwritten without free
-
ImpactKernel memory leaked (16 bytes)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Resource cleanup, leak prevention
|
| Exploitation Conditions | Requires the Intel SOF (Sound Open Firmware) HDA audio stack to be present and the snd_sof_intel_hda_generic module to execute its hda_machine_select()/sof_init_environment() probe path, where sof_pdata->tplg_filename is set via kstrdup() and later overwritten. Exploitation is bounded by: local access only (AV:L), prior privilege (PR:L in the supplied vector - driver (re)load typically needs root/CAP_SYS_MODULE), the need for matching Intel HDA/SOF audio hardware, and affected versions being limited to Linux 6.16 release candidates (rc1-rc3). The leak is a fixed 16-byte allocation per trigger, which strongly limits realistic availability impact. The complete fix is updating to a kernel containing the referenced commits (switch to devm_kstrdup); no separate mitigation is provided in the sources. |
| Impact | All signals converge on low real-world risk despite the MEDIUM CVSS of 5.5. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) is local-only and already authenticated (PR:L), with the sole impact being availability - consistent with CWE-401 (memory leak), not the 'Information Disclosure' tag applied in the input, which appears mislabeled given C:N/I:N. EPSS is very low (0.19%, 8th percentile), the CVE is NOT in CISA KEV, and no public exploit or PoC reference is provided, so exploitation status is 'no public exploit identified at time of analysis.' The vuln.today priority of 'this_month' and the availability-only rating are not mutually reinforcing: the leak is a single 16-byte kstrdup() allocation in the SOF Intel HDA machine-select path, which is not an easily weaponizable DoS primitive. I also note the A:H rating looks generous for a small, one-time leak on a specialized code path; this reads as a hygiene fix rather than an operational priority. Note also that only Linux 6.16 release-candidate kernels (rc1-rc3) are listed as affected, meaning stable production kernels are largely out of scope. |
| Exploit ScenarioDerived | A local user with the ability to load/reload the snd_sof_intel_hda_generic driver (or a system repeatedly re-running the SOF probe path) causes sof_pdata->tplg_filename to be allocated via kstrdup() and then overwritten without freeing, leaking 16 bytes of kernel memory per occurrence. Because the leak is small and the trigger requires driver (re)initialization on Intel HDA/SOF audio hardware, accumulating meaningful memory pressure is impractical. No public exploit or PoC is referenced. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 05, 2026
A memory leak (CWE-401) in the Linux kernel's ASoC Sound Open Firmware driver for Intel HDA audio (snd_sof_intel_hda_generic) causes the 16-byte tplg_filename string to be allocated with kstrdup() and then overwritten during the hda_machine_select()/sof_init_environment() probe path, so the original allocation is never freed. The flaw matters only on systems with Intel HDA/SOF audio hardware where the SOF module is reloaded repeatedly by a local user with the privileges needed to (re)load kernel modules; each trigger leaks a fixed 16-byte object, so the availability impact is limited and was detected in practice by kmemleak rather than through attack activity. No public exploit code was identified at time of analysis and EPSS is low at 0.19% (8th percentile), consistent with a low real-world risk profile despite a MEDIUM base score. Patches are available from the vendor via the referenced stable commits.
RemediationAI
Apply the upstream fix, which replaces kstrdup() with devm_kstrdup() when setting sof_pdata->tplg_filename; the corrected code is carried by the referenced stable commits (58ecf51af12cb32b890858b52b2c34e80590c74a, 68397fda2caa90e99a7c0bcb2cf604e42ef3b91f, 6c038b58a2dc5a008c7e7a1297f5aaa4deaaaa7e at git.kernel.org), so updating to a kernel build that includes the commit for your branch is the complete fix. The available sources provide no separate workaround; the leak only occurs when the SOF Intel HDA module traverses its probe path on matching Intel audio hardware, so exposure is naturally bounded by controlling who can (re)load kernel modules on such hosts, at the cost of restricting legitimate driver maintenance. Given the fixed 16-byte allocation per trigger, patch scheduling in the normal monthly window (vuln.today decision: this_month) is appropriate rather than emergency action.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a Linux kernel resource-management defect in the ALSA System-on-Chip (ASoC) layer's Sound Open Firmware (SOF) integration for Intel HDA controllers. The generic HDA machine driver (snd_sof_intel_hda_generic, reached from sof_init_environment() and sof_probe_work() in the snd_sof core) sets sof_pdata->tplg_filename by duplicating a topology filename such as "sof-hda-generic" with kstrdup(), which allocates memory the driver is responsible for freeing. Because that field can be assigned again later in the probe sequence, the earlier allocation loses its only reference and is never released - the classic CWE-401 'missing release of memory after effective lifetime' pattern that kmemleak reported as an unreferenced 16-byte object with the kstrdup call chain visible. The fix converts the assignment to devm_kstrdup(), binding the buffer to the device's lifetime so the driver core frees it automatically on unbind/teardown. The defect is confined to the Intel SOF HDA audio stack; the trigger is tied to the probe/overwrite path in that driver and no other mechanism is described in the available sources. Per the CPE data the affected code is in linux:linux_kernel with broad wildcard version ranges plus explicit coverage for 6.16-rc1 through 6.16-rc3.
Know when Intel gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Local, pre-authenticated driver-init path (AV:L/PR:L); confidentiality/integrity unaffected and a single 16-byte leak gives A:L rather than A:H.
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
In the Linux kernel, the following vulnerability has been resolved:
ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak.
sof_pdata->tplg_filename can have address allocated by kstrdup() and can be overwritten. Memory leak was detected with kmemleak:
unreferenced object 0xffff88812391ff60 (size 16): comm "kworker/4:1", pid 161, jiffies 4294802931 hex dump (first 16 bytes): 73 6f 66 2d 68 64 61 2d 67 65 6e 65 72 69 63 00 sof-hda-generic. backtrace (crc 4bf1675c): __kmalloc_node_track_caller_noprof+0x49c/0x6b0 kstrdup+0x46/0xc0 hda_machine_select.cold+0x1de/0x12cf [snd_sof_intel_hda_generic] sof_init_environment+0x16f/0xb50 [snd_sof] sof_probe_continue+0x45/0x7c0 [snd_sof] sof_probe_work+0x1e/0x40 [snd_sof] process_one_work+0x894/0x14b0 worker_thread+0x5e5/0xfb0 kthread+0x39d/0x760 ret_from_fork+0x31/0x70 ret_from_fork_asm+0x1a/0x30
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Affected Products (CPE)NVD
Apache Log4j2 contains a critical JNDI injection vulnerability known as 'Log4Shell' that allows unauthenticated remote c
An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Mana
Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable
The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and
Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable
Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable
Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable
Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable
Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of
Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable
Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable
Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable
GitHub PoC
Exploit-DB