PT-2025-44387 · Linux+3 · Linux Kernel+3

Published

2025-10-11

·

Updated

2026-04-20

·

CVE-2025-40097

CVSS v2.0

4.6

Medium

VectorAV:L/AC:L/Au:S/C:N/I:N/A:C
Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)
Description A flaw exists in the Linux kernel's ALSA subsystem, specifically within the hda component manager init function. The component match add function can assign an error pointer (ERR PTR(-ENOMEM)) to the matchptr pointer, which is then subsequently dereferenced, potentially leading to a crash. The issue arises from a missing pointer check. The vulnerability was discovered by the Linux Verification Center (linuxtesting.org) using SVACE.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Resource Release

NULL Pointer Dereference

Weakness Enumeration

CWE-404CWE-476

Related Identifiers

BDU:2026-03984
CVE-2025-40097
ECHO-6D94-D9AC-6687
OPENSUSE-SU-2025:15702-1
OPENSUSE-SU-2026:10301-1
OPENSUSE-SU-2026:20287-1
SUSE-SU-2026:0447-1
SUSE-SU-2026:0471-1
SUSE-SU-2026:0472-1
SUSE-SU-2026:0587-1
SUSE-SU-2026:20477-1
SUSE-SU-2026:20498-1
SUSE-SU-2026:20555-1
SUSE-SU-2026:20599-1
SUSE-SU-2026:20615-1
SUSE-SU-2026:20845-1
SUSE-SU-2026:20876-1
USN-8029-1
USN-8029-2
USN-8029-3
USN-8030-1
USN-8048-1

Affected Products

Debian
Linuxmint
Linux Kernel
Ubuntu