What is the CVSS score of CVE-2025-40344?

CVE-2025-40344 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2025-40344?

A use-after-free vulnerability in the Linux kernel's Intel AVS audio driver (CVE-2025-40344, CVSS 7.8) permits local users with audio hardware access to corrupt kernel memory, creating risk of data…. A patch is available.

How to fix or mitigate CVE-2025-40344?

Within 24 hours, inventory all Linux systems with Intel audio hardware (check for Intel Smart Sound Technology, AVS, or ASoC audio drivers in `lsmod` output) and cross-reference against vulnerable kernel versions in NVD. Within 7 days, prioritize systems by criticality and test kernel update candidates from your Linux vendor (RHEL, Ubuntu, SLES, etc.); simultaneously apply compensating controls on production systems. Within 30 days, deploy kernel updates as they become available from your distribution, or implement permanent mitigations (driver disabling, local access restrictions) on systems where audio functionality is not operationally required.

Linux Kernel CVE-2025-40344

HIGH

2025-12-09 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Information Disclosure Linux Red Hat Intel Suse

7.8

CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Local audio-device access sets AV:L/PR:L; exploiting the shutdown-vs-IRQ-work race requires winning a timing window so AC:H; kernel UAF yields full C/I/A impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.2 MEDIUM

qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 07:34 vuln.today

CVE Published

Dec 09, 2025 - 16:17 cve.org

HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ASoC: Intel: avs: Disable periods-elapsed work when closing PCM

avs_dai_fe_shutdown() handles the shutdown procedure for HOST HDAudio stream while period-elapsed work services its IRQs. As the former frees the DAI's private context, these two operations shall be synchronized to avoid slab-use-after-free or worse errors.

AnalysisAI

A slab use-after-free in the Linux kernel's Intel AVS (Audio Voice Speech / Smart Sound Technology) ASoC driver lets a local user with access to a HOST HDAudio PCM stream corrupt kernel memory by racing PCM close against period-elapsed IRQ work. When avs_dai_fe_shutdown() frees the DAI's private context while the period-elapsed work is still servicing interrupts, the freed structure can be accessed concurrently, yielding a use-after-free with high confidentiality, integrity and availability impact (CVSS 7.8, AV:L). There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low (0.20%, 10th percentile), reflecting the local-only, hardware-specific nature of the flaw.

Technical ContextAI

The affected component is the Intel AVS (Audio DSP) driver within the Linux kernel sound subsystem (ASoC/ALSA), which manages HDAudio HOST DMA streams on platforms using Intel Smart Sound Technology. The root cause is a missing synchronization between two code paths that touch the same DAI private context: avs_dai_fe_shutdown(), which tears down and frees the front-end DAI context when a PCM device is closed, and the period-elapsed work item, which fires from the audio stream's IRQ handler to signal buffer progress. Because the free and the work item are not serialized, the work can dereference the DAI context after it has been freed - a classic use-after-free (CWE-416); NVD lists the CWE as N/A. The fix disables/synchronizes the periods-elapsed work when closing the PCM so the free cannot race the IRQ-serviced work.

Affected ProductsAI

The Linux kernel is affected specifically in its ASoC Intel AVS (Smart Sound Technology audio DSP) driver, on systems where that driver is loaded to drive HDAudio HOST streams. No exact vulnerable/fixed version numbers are provided in the input; the fix is delivered via three stable-tree commits (git.kernel.org/stable/c/845f716dc5f354c719f6fda35048b6c2eca99331, .../b41fca4aa60be896ba8a81b57aac5dcc6eee66c0, and .../ca6d2b7aca778afbf8c0c4b330d10cb228c14052), indicating backports across multiple stable series. No CPE strings were supplied, and no separate vendor advisory URL beyond the kernel.org commits was provided.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the kernel stable-tree commits that disable the periods-elapsed work when closing the PCM (git.kernel.org/stable/c/845f716dc5f354c719f6fda35048b6c2eca99331, .../b41fca4aa60be896ba8a81b57aac5dcc6eee66c0, .../ca6d2b7aca778afbf8c0c4b330d10cb228c14052) by updating to the corresponding stable kernel release from your distribution once it ships them. As a compensating control where patching is delayed, restrict local access to the audio PCM devices (for example remove untrusted users from the 'audio' group and tighten /dev/snd permissions), or blacklist/unload the Intel AVS driver (snd-soc-avs) on systems that do not require it - the trade-off is loss of audio functionality on affected hardware. Because exploitation is strictly local, limiting untrusted local logins and constraining container/VM guest access to sound devices also reduces exposure without disabling audio for trusted users.

More in Intel

View all

CVE-2021-44228 CRITICAL Act Now POC

10.0 Dec 10

Apache Log4j2 contains a critical JNDI injection vulnerability known as 'Log4Shell' that allows unauthenticated remote c

CVE-2017-5689 CRITICAL Act Now POC

9.8 May 02

An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Mana

CVE-2012-5958 CRITICAL Act Now POC

10.0 Jan 31