logo_clicknbuy.png

CVE-2025-23134 – ALSA Timer Mutex Deadlock Vulnerability

The following table lists the changes that have been made to the
CVE-2025-23134 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution
of a vulnerability, and for identifying the most recent changes that may
impact the vulnerability’s severity, exploitability, or other characteristics.

  • New CVE Received
    by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Apr. 16, 2025

    Action Type Old Value New Value
    Added Description In the Linux kernel, the following vulnerability has been resolved:

    ALSA: timer: Don’t take register_mutex with copy_from/to_user()

    The infamous mmap_lock taken in copy_from/to_user() can be often
    problematic when it’s called inside another mutex, as they might lead
    to deadlocks.

    In the case of ALSA timer code, the bad pattern is with
    guard(mutex)(&register_mutex) that covers copy_from/to_user() — which
    was mistakenly introduced at converting to guard(), and it had been
    carefully worked around in the past.

    This patch fixes those pieces simply by moving copy_from/to_user() out
    of the register mutex lock again.
    Added Reference https://git.kernel.org/stable/c/15291b561d8cc835a2eea76b394070cf8e072771
    Added Reference https://git.kernel.org/stable/c/296f7a9e15aab276db11206cbc1e2ae1215d7862
    Added Reference https://git.kernel.org/stable/c/3424c8f53bc63c87712a7fc22dc13d0cc85fb0d6
    Added Reference https://git.kernel.org/stable/c/b074f47e55df93832bbbca1b524c501e6fea1c0d
Share the Post:

Related Posts