CVE-2025-40338

ASoC: Intel: avs: Do not share the name pointer between components

State: Published
Severity: Not scored
Published: Dec 9, 2025
Updated: Oct 30, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

ASoC: Intel: avs: Do not share the name pointer between components

By sharing 'name' directly, tearing down components may lead to use-after-free errors. Duplicate the name to avoid that.

At the same time, update the order of operations - since commit cee28113db17 ("ASoC: dmaengine_pcm: Allow passing component name via config") the framework does not override component->name if set before invoking the initializer.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	f1b3b320bd6519b16e3480f74f2926d106e3bcba to before 0e1440e0d8b2394adfc3f1ac0710e6419600d5c1Affected f1b3b320bd6519b16e3480f74f2926d106e3bcba to before 0a187ea7a5b4e78b9be1f9c1507cff04f3ae4ab1Affected f1b3b320bd6519b16e3480f74f2926d106e3bcba to before a80a82f567f7c6276d96409377d4691ea30d18a2Affected f1b3b320bd6519b16e3480f74f2926d106e3bcba to before 128bf29c992988f8b4f3829227339908fde5ec86Affected f1b3b320bd6519b16e3480f74f2926d106e3bcba to before 4dee5c1cc439b0d5ef87f741518268ad6a95b23dAffected
LinuxLinux	5.19Affected before 5.19Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.114 through 6.12.Not affected 6.17.8 through 6.17.Not affected 6.18 and laterNot affected

Product

Versions

LinuxLinux

f1b3b320bd6519b16e3480f74f2926d106e3bcba to before 0e1440e0d8b2394adfc3f1ac0710e6419600d5c1Affected
f1b3b320bd6519b16e3480f74f2926d106e3bcba to before 0a187ea7a5b4e78b9be1f9c1507cff04f3ae4ab1Affected
f1b3b320bd6519b16e3480f74f2926d106e3bcba to before a80a82f567f7c6276d96409377d4691ea30d18a2Affected
f1b3b320bd6519b16e3480f74f2926d106e3bcba to before 128bf29c992988f8b4f3829227339908fde5ec86Affected
f1b3b320bd6519b16e3480f74f2926d106e3bcba to before 4dee5c1cc439b0d5ef87f741518268ad6a95b23dAffected

LinuxLinux

5.19Affected
before 5.19Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.114 through 6.12.*Not affected
6.17.8 through 6.17.*Not affected
6.18 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.