CVE-2025-37805 sound/virtio: Fix cancel_sync warnings on uninitialized work_structs

Medium 5.5 Published 8 May 2025 Updated 11 May 2026

A flaw in the Linux kernel's virtio sound driver causes a warning and potential crash when cleaning up uninitialized work structures during probe errors.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2025-37805?

CVE-2025-37805 is a medium-severity vulnerability in Linux kernel, published on 8 May 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

sound/virtio: Fix cancel_sync warnings on uninitialized work_structs

Betty reported hitting the following warning:

[ 8.709131][ T221] WARNING: CPU: 2 PID: 221 at kernel/workqueue.c:4182 ... [ 8.713282][ T221] Call trace: [ 8.713365][ T221] __flush_work+0x8d0/0x914 [ 8.713468][ T221] __cancel_work_sync+0xac/0xfc [ 8.713570][ T221] cancel_work_sync+0x24/0x34 [ 8.713667][ T221] virtsnd_remove+0xa8/0xf8 [virtio_snd ab15f34d0dd772f6d11327e08a81d46dc9c36276] [ 8.713868][ T221] virtsnd_probe+0x48c/0x664 [virtio_snd ab15f34d0dd772f6d11327e08a81d46dc9c36276] [ 8.714035][ T221] virtio_dev_probe+0x28c/0x390 [ 8.714139][ T221] really_probe+0x1bc/0x4c8 ...

It seems we're hitting the error path in virtsnd_probe(), which triggers a virtsnd_remove() which iterates over the substreams calling cancel_work_sync() on the elapsed_period work_struct.

Looking at the code, from earlier in: virtsnd_probe()->virtsnd_build_devs()->virtsnd_pcm_parse_cfg()

We set snd->nsubstreams, allocate the snd->substreams, and if we then hit an error on the info allocation or something in virtsnd_ctl_query_info() fails, we will exit without having initialized the elapsed_period work_struct.

When that error path unwinds we then call virtsnd_remove() which as long as the substreams array is allocated, will iterate through calling cancel_work_sync() on the uninitialized work struct hitting this warning.

Takashi Iwai suggested this fix, which initializes the substreams structure right after allocation, so that if we hit the error paths we avoid trying to cleanup uninitialized data.

Note: I have not yet managed to reproduce the issue myself, so this patch has had limited testing.

Feedback or thoughts would be appreciated!

Weakness: CWE-770

Which versions are affected by CVE-2025-37805?

It affects 1 product.

Products include Linux kernel.

How do I fix CVE-2025-37805?

Apply the vendor's patch.

Is CVE-2025-37805 being exploited?

There is no known exploitation of CVE-2025-37805 in the wild and no public exploit code.

All Linux kernel vulnerabilities

Sources

Also known as BELL-CVE-2025-37805, DEBIAN-CVE-2025-37805, GHSA-fg4q-8p94-mj4j, ROOT-OS-DEBIAN-12-CVE-2025-37805, ROOT-OS-UBUNTU-2204-CVE-2025-37805, ROOT-OS-UBUNTU-2404-CVE-2025-37805 and 1 more.