CVE-2025-40162: ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails
In the Linux kernel, the following vulnerability has been resolved:
ASoC: amd/sdwutils: avoid NULL deref when devmkasprintf() fails
devmkasprintf() may return NULL on memory allocation failure, but the debug message prints cpus->dainame before checking it. Move the devdbg() call after the NULL check to prevent potential NULL pointer dereference.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Move the dev_dbg() call until after checking whether devm_kasprintf() returned NULL, so cpus->dai_name is not dereferenced when memory allocation fails.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40162?
CVE-2025-40162 has a medium severity level due to the potential for NULL dereference leading to denial of service.
How do I fix CVE-2025-40162?
To fix CVE-2025-40162, update your Linux kernel to the latest version where this vulnerability has been addressed.
What impact does CVE-2025-40162 have on my system?
CVE-2025-40162 can cause system instability by triggering a NULL dereference in the audio subsystem.
Is my Linux kernel vulnerable to CVE-2025-40162?
If you are using an affected version of the Linux kernel prior to the patch, your system may be vulnerable to CVE-2025-40162.
When was CVE-2025-40162 disclosed?
CVE-2025-40162 was disclosed as part of the ongoing security updates for the Linux kernel.