Security readout for executives and security teams
Plain-English summary
A race condition in the Linux ALSA PCM OSS compatibility layer can access an audio buffer after it has been freed. A low-privileged local user may be able to trigger memory corruption, potentially affecting confidentiality, integrity, and availability. The flaw is local rather than remotely reachable according to its CVSS vector.
Executive priority
Treat this as a high-severity kernel patching item, accelerating remediation for shared, multi-user, workstation, and audio-processing systems. The sources do not indicate remote or active exploitation, so it is not established as an internet-facing emergency. Prioritize verified exposure and vendor-supported updates.
Technical view
During PCM OSS stream initialization or reconfiguration, snd_pcm_format_set_silence() could operate on runtime->dma_area while another operation freed that buffer. This creates a use-after-free race outside PCM operation locking. The kernel fix moves buffer clearing into the PCM core and protects it with the buffer access lock.
Likely exposure
Likely exposure is Linux systems running an affected kernel where low-privileged local users can reach ALSA PCM OSS functionality. Network-only attackers are not indicated. The supplied version data has unclear range semantics, so confirm applicability through distribution advisories or by checking whether the running kernel contains the relevant stable fix.
Exploitation context
The supplied record marks KEV false and provides no evidence of active exploitation or a public exploit. Its CVSS vector indicates local access, low privileges, low complexity, and no user interaction. Practical exposure depends on whether an attacker can access the affected PCM OSS functionality.
Researcher notes
The record assigns CVSS 3.1 score 7.8 but no CWE. The core issue is a runtime->dma_area lifetime race during PCM OSS silence initialization. Stable commits implement locking-based remediation. Exact vulnerable branch boundaries are not clearly represented in the supplied version list and should be resolved through commit ancestry or distribution advisories.
Mitigation direction
- Install a vendor-supported kernel update incorporating the applicable Linux stable fix.
- Follow the relevant distribution security advisory for package and release-specific remediation.
- Reboot into the updated kernel after installation.
- If patching is delayed, consult the distribution vendor for supported interim controls.
Validation and detection
- Record each system's running kernel version and distribution package revision.
- Check distribution advisories for whether that package includes CVE-2025-38078 remediation.
- Confirm the running kernel changed after updating and rebooting.
- Identify systems permitting untrusted local users to access ALSA PCM OSS functionality.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38078 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/c0e05a76fc727929524ef24a19c302e6dd40233fCVE reference, Linux
- https://git.kernel.org/stable/c/8170d8ec4efd0be352c14cb61f374e30fb0c2a25CVE reference, Linux
- https://git.kernel.org/stable/c/10217da9644ae75cea7330f902c35fc5ba78bbbfCVE reference, Linux
- https://git.kernel.org/stable/c/f3e14d706ec18faf19f5a6e75060e140fea05d4aCVE reference, Linux
- https://git.kernel.org/stable/c/74d90875f3d43f3eff0e9861c4701418795d3455CVE reference, Linux
- https://git.kernel.org/stable/c/bf85e49aaf3a3c5775ea87369ea5f159c2148db4CVE reference, Linux
- https://git.kernel.org/stable/c/afa56c960fcb4db37f2e3399f28e9402e4e1f470CVE reference, Linux
- https://git.kernel.org/stable/c/93a81ca0657758b607c3f4ba889ae806be9beb73CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.