CVE-2025-23134

CVSS 3.1 Score 5.5 of 10 (medium)

Details

Published Apr 16, 2025
Updated: Apr 29, 2025
CWE ID 667

Summary

CVE-2025-23134 is a vulnerability affecting the Linux kernel ALSA (Advanced Linux Sound Architecture) timer subsystem. The issue arises from taking the register_mutex mutex while performing copy_from/to_user() operations. This pattern can result in deadlocks due to the infamous mmap_lock taken inside copy_from/to_user(). The ALSA timer code introduced this bad pattern unintentionally when converting to the guard() mechanism, and this patch resolves it by moving the copy_from/to_user() operations outside the register mutex lock once more.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share