CVE-2025-40338None▾ Sunlit

In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Do not share the name pointer between components By sharing 'name' directly, tearing down components may lead to use-after-free errors

In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Do not share the name pointer between components By sharing 'name' directly, tearing down components may lead to use-after-free errors. Duplicate the…

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score3/ 100 · Minimal

impact 2.8 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Dec 9, 2025

Updated

Oct 14, 2026

CVSS

—

Vendor

—

Product

—

CWE

—

Depth score

3 · Minimal

EPSS

0.21% · p11

Platforms

—

Source

NVD

Vector

—

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 309 days

Dec 9, 2025Published
Disclosed via NVD
Oct 14, 2026Record revised
Last analysed / modified upstream
Oct 14, 2026EPSS first tracked
0.2%

#nvd

Full technical detail▾

Overview

In the Linux kernel, the following vulnerability has been resolved:

ASoC: Intel: avs: Do not share the name pointer between components

By sharing 'name' directly, tearing down components may lead to use-after-free errors. Duplicate the name to avoid that.

At the same time, update the order of operations - since commit cee28113db17 ("ASoC: dmaengine_pcm: Allow passing component name via config") the framework does not override component->name if set before invoking the initializer.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References