LiveActive security incident?Get immediate response
CVE Record

CVE-2025-39930: ASoC: simple-card-utils: Don't use __free(device_node) at graph_util_parse_dai()

In the Linux kernel, the following vulnerability has been resolved: ASoC: simple-card-utils: Don't use __free(device_node) at graph_util_parse_dai() commit 419d1918105e ("ASoC: simple-card-utils: use __free(device_node) for device node") uses __free(device_node) for dlc->of_node, but we need to keep it while driver is in use. Don't use __free(device_node) in graph_util_parse_dai().

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's Takeunknown

Analyst readout for executives and security teams

Plain-English summary

This is a Linux kernel defect in audio driver support code. A device-tree reference could be released too early while the driver still needs it. The public record does not provide a severity score, concrete impact, or evidence of exploitation, so business urgency depends on whether affected kernel builds run on relevant systems.

Executive priority

Treat this as a kernel maintenance item with uncertain severity. Prioritize normal patching, then raise urgency for exposed embedded or device fleets using the affected audio driver path.

Technical view

The issue is in Linux ASoC simple-card-utils, graph_util_parse_dai(). A prior change used __free(device_node) for dlc->of_node, but that node must remain valid while the driver is in use. The fix removes that automatic cleanup pattern. Public data lists Linux kernel versions and stable commits, but gives no CVSS, CWE, or exploit details.

Likely exposure

Likely exposure is Linux systems running affected kernel builds with the relevant ASoC simple-card/device-tree audio path enabled. This is most relevant to embedded, appliance, mobile, or hardware-specific Linux deployments. Generic servers may be unaffected if the driver path is absent, disabled, or vendor-patched.

Exploitation context

The CVE is not listed as KEV in the provided bundle, and no cited source states active exploitation. The sources do not describe a public exploit, attack prerequisites, or security impact beyond the kernel fix rationale.

Researcher notes

The record is sparse: no CVSS, CWE, exploit status, or detailed impact is provided. The affected-version data appears kernel-specific and should be reconciled against vendor backports and the referenced stable commits before declaring exposure.

Mitigation direction

  • Check your Linux vendor advisory for CVE-2025-39930 coverage.
  • Update affected kernels to a vendor build containing the stable fix.
  • Prioritize embedded or hardware platforms using ASoC simple-card audio.
  • Confirm whether vendor backports already include the referenced kernel commits.

Validation and detection

  • Inventory deployed kernel versions and vendor patch levels.
  • Check whether ASoC simple-card support is enabled or used.
  • Verify source or package changelogs include the referenced stable commits.
  • Document any affected devices awaiting vendor kernel updates.
Prepared
Confidence
medium
Sources
6

Public sources used

Based on public source material and reviewed before publication.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-39930 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
5Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxe03f8d14191142849abad62307d4128afd304521, 142a386a805809e21361976d566392bcd07870b8, 419d1918105e5d9926ab02f1f834bb416dc76f65, 419d1918105e5d9926ab02f1f834bb416dc76f65, 6.6.130, 6.12.78unaffected
LinuxLinux6.14, 0, 6.6.135, 6.12.82, 6.14.2, 6.15affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.