CVE-2025-38105

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified)

Description: A vulnerability in the Linux kernel's USB-audio MIDI code has been identified. The issue arises when the driver is freed without the disconnect call, leaving a timer in an active state. This results in a kernel warning when the debug configuration is enabled. The problem occurs due to the improper initialization of the timer.

Recommendations: For the Linux kernel, to resolve the issue, put timer shutdown sync() at snd usbmidi free(), so that the timer can be killed properly. Additionally, replace the existing timer delete sync() at the disconnect callback with timer shutdown sync().