CVE-2025-40097

Source
https://cve.org/CVERecord?id=CVE-2025-40097
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-40097.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-40097
Downstream
BELL (1)
DEBIAN (1)
ECHO (1)
openSUSE (3)
ROOT (4)
SUSE (12)
UBUNTU (1)
Related
Published
2025-10-30T09:48:04Z
Modified
2026-10-05T02:30:46Z
Summary
ALSA: hda: Fix missing pointer check in hda_component_manager_init function
Details

In the Linux kernel, the following vulnerability has been resolved:

ALSA: hda: Fix missing pointer check in hda_component_manager_init function

The __component_match_add function may assign the 'matchptr' pointer the value ERR_PTR(-ENOMEM), which will subsequently be dereferenced.

The call stack leading to the error looks like this:

hda_component_manager_init |-> component_match_add |-> component_match_add_release |-> __component_match_add ( ... ,**matchptr, ... ) |-> *matchptr = ERR_PTR(-ENOMEM); // assign |-> component_master_add_with_match( ... match) |-> component_match_realloc(match, match->num); // dereference

Add IS_ERR() check to prevent the crash.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Database specific
{
    "cna_assigner":  "Linux",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40097.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
ae7abe36e352eddf8e30d3b1ea3fb402514ba13b
Fixed
b044aa6ae63391ba40c93ca5d476d276cb17db1b
Fixed
1c3f4b15eb1850558d7d4da74b98cffbb8121721
Fixed
218a8504e62fc2c8a1fd12523346b7a2b9bd2474
Fixed
47d1b9ca923b55c3f407788f1f15b04957e0e027
Fixed
1cf11d80db5df805b538c942269e05a65bcaf5bc

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-40097.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.17.0
Fixed
6.1.189
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.158
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.59
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.17.5

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-40097.json"