---
id: CVE-2025-38105
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ALSA: usb-audio: Kill timer properly at removal

  The USB-audio MIDI code initializes the timer, but in a rare case, the
  driver might be freed without the disconnect cal…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ALSA: usb-audio: Kill timer properly at removal

  The USB-audio MIDI code initializes the timer, but in a rare case, the
  driver might be freed without the disconnect cal…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 2.6.14, < 6.6.111'
  - 'linux_kernel >= 6.7, < 6.12.52'
  - 'linux_kernel >= 6.13, < 6.15.3'
patched:
  - linux_kernel 6.15.3
published: '2025-07-03'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T02:17:51.070'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-38105'
references:
  - url: 'https://git.kernel.org/stable/c/06513dd6d32c37d0364db8488cfdf3e14da238a8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/0718a78f6a9f04b88d0dc9616cc216b31c5f3cf1'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/62066758d2ae169278e5d6aea5995b1b6f6ddeb5'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/647410a7da46067953a53c0d03f8680eff570959'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c611b9e55174e439dcd85a72969b43a95f3827a4'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/efaf61052b8ff9ee8968912fbaf02c2847c78ede'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-784472.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
epss: 0.00191
epssPercentile: 0.08673
ingestedAt: '2026-10-15T03:30:12.815Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: Kill timer properly at removal

The USB-audio MIDI code initializes the timer, but in a rare case, the
driver might be freed without the disconnect call.  This leaves the
timer in an active state while the assigned object is released via
snd_usbmidi_free(), which ends up with a kernel warning when the debug
configuration is enabled, as spotted by fuzzer.

For avoiding the problem, put timer_shutdown_sync() at
snd_usbmidi_free(), so that the timer can be killed properly.
While we're at it, replace the existing timer_delete_sync() at the
disconnect callback with timer_shutdown_sync(), too.

## Affected

- `linux_kernel >= 2.6.14, < 6.6.111`
- `linux_kernel >= 6.7, < 6.12.52`
- `linux_kernel >= 6.13, < 6.15.3`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.15.3`