CVE-2025-40344

A use-after-free vulnerability was found in the Intel AVS (Audio Voice Speech) sound driver in the Linux kernel. When closing a PCM stream, avs_dai_fe_shutdown() frees the DAI's private context while the period-elapsed work may still be servicing IRQs and accessing this context. This race condition can lead to use-after-free errors, potentially causing kernel crashes or memory corruption.

This is a use-after-free vulnerability in the Intel AVS audio driver that can cause kernel crashes during audio stream shutdown. The impact is limited to systems with Intel audio hardware using the AVS driver.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the snd_soc_avs module from being loaded. See https://access.redhat.com/solutions/41278 for instructions on how to blacklist a kernel module.