Skip to main content

Linux Kernel CVE-2025-40317

| EUVDEUVD-2025-201628 HIGH
2025-12-08 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
6.6 MEDIUM

Local audio-stack trigger by a low-priv user (AV:L/AC:L/PR:L); dominant confirmed impact is a kernel crash (A:H), with only inferred limited memory disclosure/corruption (C:L/I:L).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
CVSS changed
Jul 30, 2026 - 06:37 NVD
7.8 (HIGH)
Patch released
Mar 16, 2026 - 15:00 nvd
Patch available
EUVD ID Assigned
Mar 15, 2026 - 17:54 euvd
EUVD-2025-201628
Analysis Generated
Mar 15, 2026 - 17:54 vuln.today
CVE Published
Dec 08, 2025 - 01:16 cve.org
HIGH 7.8
CVE Published
Dec 08, 2025 - 01:16 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

regmap: slimbus: fix bus_context pointer in regmap init calls

Commit 4e65bda8273c ("ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()") revealed the problem in the slimbus regmap. That commit breaks audio playback, for instance, on sdm845 Thundercomm Dragonboard 845c board:

Unable to handle kernel paging request at virtual address ffff8000847cbad4 ... CPU: 5 UID: 0 PID: 776 Comm: aplay Not tainted 6.18.0-rc1-00028-g7ea30958b305 #11 PREEMPT Hardware name: Thundercomm Dragonboard 845c (DT) ... Call trace: slim_xfer_msg+0x24/0x1ac [slimbus] (P) slim_read+0x48/0x74 [slimbus] regmap_slimbus_read+0x18/0x24 [regmap_slimbus] _regmap_raw_read+0xe8/0x174 _regmap_bus_read+0x44/0x80 _regmap_read+0x60/0xd8 _regmap_update_bits+0xf4/0x140 _regmap_select_page+0xa8/0x124 _regmap_raw_write_impl+0x3b8/0x65c _regmap_bus_raw_write+0x60/0x80 _regmap_write+0x58/0xc0 regmap_write+0x4c/0x80 wcd934x_hw_params+0x494/0x8b8 [snd_soc_wcd934x] snd_soc_dai_hw_params+0x3c/0x7c [snd_soc_core] __soc_pcm_hw_params+0x22c/0x634 [snd_soc_core] dpcm_be_dai_hw_params+0x1d4/0x38c [snd_soc_core] dpcm_fe_dai_hw_params+0x9c/0x17c [snd_soc_core] snd_pcm_hw_params+0x124/0x464 [snd_pcm] snd_pcm_common_ioctl+0x110c/0x1820 [snd_pcm] snd_pcm_ioctl+0x34/0x4c [snd_pcm] __arm64_sys_ioctl+0xac/0x104 invoke_syscall+0x48/0x104 el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x34/0xec el0t_64_sync_handler+0xa0/0xf0 el0t_64_sync+0x198/0x19c

The __devm_regmap_init_slimbus() started to be used instead of __regmap_init_slimbus() after the commit mentioned above and turns out the incorrect bus_context pointer (3rd argument) was used in __devm_regmap_init_slimbus(). It should be just "slimbus" (which is equal to &slimbus->dev). Correct it. The wcd934x codec seems to be the only or the first user of devm_regmap_init_slimbus() but we should fix it till the point where __devm_regmap_init_slimbus() was introduced therefore two "Fixes" tags.

While at this, also correct the same argument in __regmap_init_slimbus().

AnalysisAI

Kernel memory corruption in the Linux kernel SLIMbus regmap layer (regmap-slimbus) occurs because __devm_regmap_init_slimbus() and __regmap_init_slimbus() passed an incorrect bus_context pointer, causing an invalid-address dereference during SLIMbus register I/O. On affected Qualcomm-based platforms (e.g. wcd934x audio codec on SDM845 boards), a local user triggering audio playback crashes the kernel and may corrupt or disclose memory. This is a resolved regression exposed by commit 4e65bda8273c; there is no public exploit identified at time of analysis and EPSS probability is negligible (0.05%).

Technical ContextAI

SLIMbus (Serial Low-power Inter-chip Media Bus) is used on Qualcomm SoCs to connect the CPU to audio codecs. The kernel's regmap abstraction provides a uniform register-access API over transports like I2C, SPI and SLIMbus; regmap_slimbus is the SLIMbus backend. During init, regmap stores a bus_context that is later handed back to the bus read/write callbacks (regmap_slimbus_read/write) which pass it to slim_read()/slim_xfer_msg(). The fix corrects the 3rd argument so the context is 'slimbus' (equivalent to &slimbus->dev) rather than a wrong pointer; the buggy value led to the call trace faulting in slim_xfer_msg while dereferencing an invalid virtual address. The root-cause class is an incorrect-pointer/invalid-pointer dereference (aligned with CWE-476/CWE-763-style pointer misuse); NVD lists CWE as N/A. The regression became reachable only after wcd934x switched from __regmap_init_slimbus() to the devm_ variant.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 6.1.159, 5.15.197, 5.10.247, 5.4.302, 6.6.117, 6.12.58, 6.17.8, or mainline 6.18 (see the kernel.org stable commits, e.g. https://git.kernel.org/stable/c/8143e4075d131c528540417a51966f6697be14eb and https://git.kernel.org/stable/c/a16e92f8d7dc7371e68f17a9926cb92d2244be7b). Distribution users should apply Ubuntu USN-8095-1 / USN-8096-1 (https://ubuntu.com/security/notices/USN-8095-1) and reboot into the patched kernel. If immediate patching is not possible on affected embedded boards, a compensating control is to avoid loading/using the SLIMbus audio path - e.g. do not load the regmap_slimbus / snd_soc_wcd934x modules or keep the codec unused - which prevents the faulting playback path at the cost of losing audio functionality on that device; this only helps where the SLIMbus codec is not required for operation.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.95 Image SL-Micro Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.115 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.146 Affected
Container suse/sl-micro/6.0/toolbox:latest Affected

Share

CVE-2025-40317 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy