Review reviewHigh

CVE-2025-40344

Linux

In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Disable periods-elapsed work when closing PCM avs_dai_fe_shutdown() handles the shutdown procedure for HOST HDAudio stream while period-elapsed work services its IRQs. As the former frees the DAI's private context, these two operations shall be synchronized to avoid slab-use-after-free or worse errors.

CVSS: 7.8
EPSS: 0.15%
CISA KEV: Not listed
Published: 2025.12.10

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.15%

Technical severityCVSS 7.8

Vulnerability overview

Affected product and versions

Product: Linux
Affected versions: >= 0dbb186c3510cad4e9f443e801bf2e6ab5770c00 < ca6d2b7aca778afbf8c0c4b330d10cb228c14052, >= 0dbb186c3510cad4e9f443e801bf2e6ab5770c00 < b41fca4aa60be896ba8a81b57aac5dcc6eee66c0, >= 0dbb186c3510cad4e9f443e801bf2e6ab5770c00 < 845f716dc5f354c719f6fda35048b6c2eca99331, >= 31087af37d6b1586b76d4acf3e0c1634a4617ba6, >= 6.11.9 < 6.12, >= 6.12
Fixed versions: No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Linux and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: Not available