Skip to main content

Linux Kernel CVE-2025-40045

HIGH
2025-10-28 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Buffer Overflow Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Reachable only via local access on hardware with the wcd937x driver, requiring low privileges (PR:L, AV:L); in-kernel memory corruption yields high C/I/A within an unchanged scope.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
6.1 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 07:54 vuln.today
CVE Published
Oct 28, 2025 - 12:15 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ASoC: codecs: wcd937x: set the comp soundwire port correctly

For some reason we endup with setting soundwire port for HPHL_COMP and HPHR_COMP as zero, this can potentially result in a memory corruption due to accessing and setting -1 th element of port_map array.

AnalysisAI

Memory corruption in the Linux kernel's wcd937x ASoC audio codec driver occurs because the SoundWire port for the HPHL_COMP and HPHR_COMP compander components is set to zero, causing an out-of-bounds access at index -1 of the port_map array during driver operation. Local low-privileged users on devices using this Qualcomm codec can trigger kernel memory corruption (CVSS 7.8). There is no public exploit identified at time of analysis, EPSS risk is low (0.20%, 10th percentile), and the fix has already been merged upstream.

Technical ContextAI

The affected component is the wcd937x codec driver under the ALSA System-on-Chip (ASoC) subsystem, which manages a Qualcomm WCD937x audio codec attached over the SoundWire (SDW) bus. The driver maintains a port_map array that maps logical codec components to physical SoundWire ports. The bug arises when the compander (COMP) ports for the left and right headphone channels (HPHL_COMP, HPHR_COMP) are incorrectly initialized to zero; downstream logic then decrements or indexes this into a negative offset, reading/writing the '-1'th element of port_map. This is a classic out-of-bounds/buffer-overflow condition (aligning with the 'Buffer Overflow' tag); NVD lists CWE as N/A, so the exact weakness class was not formally assigned.

Affected ProductsAI

The affected product is the Linux kernel, specifically the ASoC wcd937x codec driver used with Qualcomm WCD937x audio codecs on SoundWire-equipped hardware. Exact affected version ranges are not provided as CPE data in the input; the fix is distributed across three stable-tree commits (git.kernel.org/stable/c/1a1ca38392e7e896075afc8905ddaea525ed30f7, /66a940b1bf48a7095162688332d725ba160154eb, and /abcd537aae3b84c6d10ad147e99a204bcb56b234), indicating multiple maintained stable branches were patched. Any kernel build including the wcd937x driver prior to these commits should be considered affected until confirmed otherwise against distribution changelogs.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the stable-tree commits referenced at git.kernel.org/stable/c/1a1ca38392e7e896075afc8905ddaea525ed30f7, /66a940b1bf48a7095162688332d725ba160154eb, and /abcd537aae3b84c6d10ad147e99a204bcb56b234, or upgrade to the distribution kernel package that incorporates them. Where immediate patching is not possible on affected Qualcomm hardware, a compensating control is to blacklist or unload the wcd937x kernel module (e.g., prevent the snd-soc-wcd937x module from loading) if the codec is not required, accepting the trade-off of losing headphone/audio functionality on that codec. Restricting local access to trusted users also reduces exposure given the local-only attack vector, though it does not remediate the underlying flaw.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/kvm-os-container:latest Container suse/sl-micro/6.0/rt-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Image SL-Micro Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Affected
Image SLES-Azure-3P Image SLES-Azure-Basic Image SLES-Azure-Standard Image SLES-BYOS-Azure Image SLES-BYOS-EC2 Image SLES-BYOS-GCE Image SLES-CHOST-BYOS-Aliyun Image SLES-CHOST-BYOS-Azure Image SLES-CHOST-BYOS-EC2 Image SLES-CHOST-BYOS-GCE Image SLES-CHOST-BYOS-GDC Image SLES-CHOST-BYOS-SAP-CCloud Image SLES-EC2 Image SLES-EC2-ECS Image SLES-GCE Image SLES-GCE-3P Image SLES-Hardened-BYOS-Azure Image SLES-Hardened-BYOS-EC2 Image SLES-Hardened-BYOS-GCE Image SLES-SAPCAL-Azure Image SLES-SAPCAL-EC2 Image SLES-SAPCAL-GCE Affected
Image SLES-SAP-Azure Image SLES-SAP-Azure-3P Image SLES-SAP-BYOS-Azure Image SLES-SAP-BYOS-EC2 Image SLES-SAP-BYOS-GCE Image SLES-SAP-EC2 Image SLES-SAP-GCE Image SLES-SAP-GCE-3P Affected
SUSE Linux Enterprise High Availability Extension 16.0 Fixed
SUSE Linux Enterprise Server 16.0 Fixed

Share

CVE-2025-40045 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy