{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-05-13T14:19:42.816","vulnerabilities":[{"cve":{"id":"CVE-2025-37805","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2025-05-08T07:15:51.667","lastModified":"2025-11-03T20:18:36.177","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsound/virtio: Fix cancel_sync warnings on uninitialized work_structs\n\nBetty reported hitting the following warning:\n\n[    8.709131][  T221] WARNING: CPU: 2 PID: 221 at kernel/workqueue.c:4182\n...\n[    8.713282][  T221] Call trace:\n[    8.713365][  T221]  __flush_work+0x8d0/0x914\n[    8.713468][  T221]  __cancel_work_sync+0xac/0xfc\n[    8.713570][  T221]  cancel_work_sync+0x24/0x34\n[    8.713667][  T221]  virtsnd_remove+0xa8/0xf8 [virtio_snd ab15f34d0dd772f6d11327e08a81d46dc9c36276]\n[    8.713868][  T221]  virtsnd_probe+0x48c/0x664 [virtio_snd ab15f34d0dd772f6d11327e08a81d46dc9c36276]\n[    8.714035][  T221]  virtio_dev_probe+0x28c/0x390\n[    8.714139][  T221]  really_probe+0x1bc/0x4c8\n...\n\nIt seems we're hitting the error path in virtsnd_probe(), which\ntriggers a virtsnd_remove() which iterates over the substreams\ncalling cancel_work_sync() on the elapsed_period work_struct.\n\nLooking at the code, from earlier in:\nvirtsnd_probe()->virtsnd_build_devs()->virtsnd_pcm_parse_cfg()\n\nWe set snd->nsubstreams, allocate the snd->substreams, and if\nwe then hit an error on the info allocation or something in\nvirtsnd_ctl_query_info() fails, we will exit without having\ninitialized the elapsed_period work_struct.\n\nWhen that error path unwinds we then call virtsnd_remove()\nwhich as long as the substreams array is allocated, will iterate\nthrough calling cancel_work_sync() on the uninitialized work\nstruct hitting this warning.\n\nTakashi Iwai suggested this fix, which initializes the substreams\nstructure right after allocation, so that if we hit the error\npaths we avoid trying to cleanup uninitialized data.\n\nNote: I have not yet managed to reproduce the issue myself, so\nthis patch has had limited testing.\n\nFeedback or thoughts would be appreciated!"},{"lang":"es","value":"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: sound/virtio: Se corrigen las advertencias de cancel_sync en work_structs no inicializados Betty informó haber recibido la siguiente advertencia: [ 8.709131][ T221] ADVERTENCIA: CPU: 2 PID: 221 en kernel/workqueue.c:4182 ... [ 8.713282][ T221] Rastreo de llamadas: [ 8.713365][ T221] __flush_work+0x8d0/0x914 [ 8.713468][ T221] __cancel_work_sync+0xac/0xfc [ 8.713570][ T221] cancel_work_sync+0x24/0x34 [ 8.713667][ T221] virtsnd_remove+0xa8/0xf8 [virtio_snd ab15f34d0dd772f6d11327e08a81d46dc9c36276] [ 8.713868][ T221] virtsnd_probe+0x48c/0x664 [virtio_snd ab15f34d0dd772f6d11327e08a81d46dc9c36276] [ 8.714035][ T221] virtio_dev_probe+0x28c/0x390 [ 8.714139][ T221] really_probe+0x1bc/0x4c8 ... Parece que estamos llegando a la ruta de error en virtsnd_probe(), que activa un virtsnd_remove() que itera sobre los subflujos que llaman a cancel_work_sync() en el elapsed_period work_struct. Mirando el código anterior: virtsnd_probe()->virtsnd_build_devs()->virtsnd_pcm_parse_cfg() Establecemos snd->nsubstreams, asignamos los snd->substreams y, si encontramos un error en la asignación de información o algo en virtsnd_ctl_query_info() falla, saldremos sin haber inicializado el work_struct elapsed_period. Cuando se deshaga esa ruta de error, llamamos a virtsnd_remove() que, mientras la matriz de substreams esté asignada, iterará llamando a cancel_work_sync() en la estructura de trabajo no inicializada que encuentre esta advertencia. Takashi Iwai sugirió esta solución, que inicializa la estructura de substreams justo después de la asignación, de modo que, si encontramos las rutas de error, evitamos intentar limpiar los datos no inicializados. Nota: Todavía no he logrado reproducir el problema yo mismo, por lo que este parche ha tenido pruebas limitadas. ¡Se agradecerían sus comentarios o ideas!"}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-770"}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.181","matchCriteriaId":"E1AE45B7-B31B-48DF-9F83-959F56624B62"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.16","versionEndExcluding":"6.1.136","matchCriteriaId":"27735C1B-DDFC-4860-8952-1D01025F9D4C"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.6.89","matchCriteriaId":"D79CE030-3114-45E0-B52B-C77781BCB587"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.12.26","matchCriteriaId":"22F52099-F422-4D19-8283-45F9F9BF4392"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13","versionEndExcluding":"6.14.5","matchCriteriaId":"6B25CA7E-4CD0-46DB-B4EF-13A3516071FB"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/3c7df2e27346eb40a0e86230db1ccab195c97cfe","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/54c7b864fbe4423a07b443a4ada0106052942116","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/5be9407b41eae20eef9140f5cfbfcbc3d01aaf45","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/66046b586c0aaa9332483bcdbd76e3305d6138e9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/9908498ce929a5a052b79bb7942f9ea317312ce4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/e03b10c45c7675b6098190c6e7de1b656d8bcdbe","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html","source":"af854a3a-2127-422b-91ae-364da2661108"}]}}]}