CVE-2025-38078

A flaw was found in the Linux kernel. A local attacker could exploit a race condition in the Pulse-Code Modulation (PCM) Open Sound System (OSS) layer's buffer access. This could lead to a use-after-free (UAF) vulnerability, where memory is accessed after it has been freed. This flaw may allow for information disclosure, privilege escalation, or arbitrary code execution.

This vulnerability is rated as a Moderate severity flaw for Red Hat Enterprise Linux because exploitation requires local system access, specific timing to win a race condition, and interaction with legacy sound interfaces. Modern Red Hat Enterprise Linux deployments primarily rely on native ALSA interfaces or userspace sound servers such as PipeWire and PulseAudio, making the legacy OSS PCM emulation layer uncommonly utilized in standard environments. While a local attacker could trigger a use-after-free condition leading to a system crash or potential kernel-level code execution, the prerequisite local access and legacy configuration requirement reduce the attack surface.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.