CVE-2025-40097
published 2025-10-30CVE-2025-40097: In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: Fix missing pointer check in hda_component_manager_init function The…
PriorityP421medium5.5
EPSS
0.18%
8.3th percentile
In the Linux kernel, the following vulnerability has been resolved:
ALSA: hda: Fix missing pointer check in hda_component_manager_init function
The __component_match_add function may assign the 'matchptr' pointer
the value ERR_PTR(-ENOMEM), which will subsequently be dereferenced.
The call stack leading to the error looks like this:
hda_component_manager_init
|-> component_match_add
|-> component_match_add_release
|-> __component_match_add ( ... ,**matchptr, ... )
|-> *matchptr = ERR_PTR(-ENOMEM); // assign
|-> component_master_add_with_match( ... match)
|-> component_match_realloc(match, match->num); // dereference
Add IS_ERR() check to prevent the crash.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.17.6-1 (forky) | linux 6.17.6-1 (forky) |
| linux | linux | — | — |
| linux | linux | >= ae7abe36e352eddf8e30d3b1ea3fb402514ba13b < 218a8504e62fc2c8a1fd12523346b7a2b9bd2474 | 218a8504e62fc2c8a1fd12523346b7a2b9bd2474 |
| linux | linux | >= ae7abe36e352eddf8e30d3b1ea3fb402514ba13b < 47d1b9ca923b55c3f407788f1f15b04957e0e027 | 47d1b9ca923b55c3f407788f1f15b04957e0e027 |
| linux | linux | >= ae7abe36e352eddf8e30d3b1ea3fb402514ba13b < 1cf11d80db5df805b538c942269e05a65bcaf5bc | 1cf11d80db5df805b538c942269e05a65bcaf5bc |
| linux | linux_kernel | >= 0 < 6.12.63-1 | 6.12.63-1 |
| linux | linux_kernel | >= 0 < 6.17.6-1 | 6.17.6-1 |
| linux | linux_kernel | >= 0 < 6.17.0-14.14 | 6.17.0-14.14 |
| linux | linux_kernel | >= 5.17.0 < 6.12.59 | 6.12.59 |
| linux | linux_kernel | >= 6.13.0 < 6.17.5 | 6.17.5 |
| msrc | azl3_kernel_6.6.104.2-4_on_azure_linux_3.0 | — | — |
| ubuntu | linux-aws | — | — |
| ubuntu | linux-oracle | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
linux-azure vulnerabilities
osv·2026-02-24
linux-azure vulnerabilities
linux-azure vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- MIPS architecture;
- Nios II architecture;
- PA-RISC architecture;
- RISC-V architecture;
- S390 architecture;
- Sun Sparc architecture;
- x86 architecture;
- Xtensa architecture;
- Block layer subsystem;
- Cryptographic API;
- Compute Acceleration Framework;
- ACPI drivers;
- Drivers core;
- Network block device driver;
- Bluetooth drivers;
- Bus devices;
- Hardware random number generator core;
- Character device driver;
- Clock framework and drivers;
- Data acquisition framework and drivers;
- CPU frequency scaling framework;
- Hardware crypto device drivers
OSV
linux-oem-6.17 vulnerabilities
osv·2026-02-17
linux-oem-6.17 vulnerabilities
linux-oem-6.17 vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- MIPS architecture;
- Nios II architecture;
- PA-RISC architecture;
- RISC-V architecture;
- S390 architecture;
- Sun Sparc architecture;
- x86 architecture;
- Xtensa architecture;
- Block layer subsystem;
- Cryptographic API;
- Compute Acceleration Framework;
- ACPI drivers;
- Drivers core;
- Network block device driver;
- Bluetooth drivers;
- Bus devices;
- Hardware random number generator core;
- Character device driver;
- Clock framework and drivers;
- Data acquisition framework and drivers;
- CPU frequency scaling framework;
- Hardware crypto device driv
OSV
linux-aws, linux-oracle vulnerabilities
osv·2026-02-17
linux-aws, linux-oracle vulnerabilities
linux-aws, linux-oracle vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- MIPS architecture;
- Nios II architecture;
- PA-RISC architecture;
- RISC-V architecture;
- S390 architecture;
- Sun Sparc architecture;
- x86 architecture;
- Xtensa architecture;
- Block layer subsystem;
- Cryptographic API;
- Compute Acceleration Framework;
- ACPI drivers;
- Drivers core;
- Network block device driver;
- Bluetooth drivers;
- Bus devices;
- Hardware random number generator core;
- Character device driver;
- Clock framework and drivers;
- Data acquisition framework and drivers;
- CPU frequency scaling framework;
- Hardware crypto de
OSV
linux-gcp vulnerabilities
osv·2026-02-12
linux-gcp vulnerabilities
linux-gcp vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- MIPS architecture;
- Nios II architecture;
- PA-RISC architecture;
- RISC-V architecture;
- S390 architecture;
- Sun Sparc architecture;
- x86 architecture;
- Xtensa architecture;
- Block layer subsystem;
- Cryptographic API;
- Compute Acceleration Framework;
- ACPI drivers;
- Drivers core;
- Network block device driver;
- Bluetooth drivers;
- Bus devices;
- Hardware random number generator core;
- Character device driver;
- Clock framework and drivers;
- Data acquisition framework and drivers;
- CPU frequency scaling framework;
- Hardware crypto device drivers;
OSV
linux, linux-raspi, linux-realtime vulnerabilities
osv·2026-02-12
linux, linux-raspi, linux-realtime vulnerabilities
linux, linux-raspi, linux-realtime vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- MIPS architecture;
- Nios II architecture;
- PA-RISC architecture;
- RISC-V architecture;
- S390 architecture;
- Sun Sparc architecture;
- x86 architecture;
- Xtensa architecture;
- Block layer subsystem;
- Cryptographic API;
- Compute Acceleration Framework;
- ACPI drivers;
- Drivers core;
- Network block device driver;
- Bluetooth drivers;
- Bus devices;
- Hardware random number generator core;
- Character device driver;
- Clock framework and drivers;
- Data acquisition framework and drivers;
- CPU frequency scaling framework;
- Hardwar
OSV
ALSA: hda: Fix missing pointer check in hda_component_manager_init function
osv·2025-10-30
CVE-2025-40097 ALSA: hda: Fix missing pointer check in hda_component_manager_init function
ALSA: hda: Fix missing pointer check in hda_component_manager_init function
In the Linux kernel, the following vulnerability has been resolved:
ALSA: hda: Fix missing pointer check in hda_component_manager_init function
The __component_match_add function may assign the 'matchptr' pointer
the value ERR_PTR(-ENOMEM), which will subsequently be dereferenced.
The call stack leading to the error looks like this:
hda_component_manager_init
|-> component_match_add
|-> component_match_add_release
|-> __component_match_add ( ... ,**matchptr, ... )
|-> *matchptr = ERR_PTR(-ENOMEM); // assign
|-> component_master_add_with_match( ... match)
|-> component_match_realloc(match, match->num); // dereference
Add IS_ERR() check to prevent the crash.
Found by Linux Verification Center (linuxtesting.org
GHSA
GHSA-9cqx-9fcv-mjx8: In the Linux kernel, the following vulnerability has been resolved:
ALSA: hda: Fix missing pointer check in hda_component_manager_init function
The
ghsa_unreviewed·2025-10-30
CVE-2025-40097 GHSA-9cqx-9fcv-mjx8: In the Linux kernel, the following vulnerability has been resolved:
ALSA: hda: Fix missing pointer check in hda_component_manager_init function
The
In the Linux kernel, the following vulnerability has been resolved:
ALSA: hda: Fix missing pointer check in hda_component_manager_init function
The __component_match_add function may assign the 'matchptr' pointer
the value ERR_PTR(-ENOMEM), which will subsequently be dereferenced.
The call stack leading to the error looks like this:
hda_component_manager_init
|-> component_match_add
|-> component_match_add_release
|-> __component_match_add ( ... ,**matchptr, ... )
|-> *matchptr = ERR_PTR(-ENOMEM); // assign
|-> component_master_add_with_match( ... match)
|-> component_match_realloc(match, match->num); // dereference
Add IS_ERR() check to prevent the crash.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
OSV
CVE-2025-40097: In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: Fix missing pointer check in hda_component_manager_init function The __
osv·2025-10-30
CVE-2025-40097 CVE-2025-40097: In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: Fix missing pointer check in hda_component_manager_init function The __
In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: Fix missing pointer check in hda_component_manager_init function The __component_match_add function may assign the 'matchptr' pointer the value ERR_PTR(-ENOMEM), which will subsequently be dereferenced. The call stack leading to the error looks like this: hda_component_manager_init |-> component_match_add |-> component_match_add_release |-> __component_match_add ( ... ,**matchptr, ... ) |-> *matchptr = ERR_PTR(-ENOMEM); // assign |-> component_master_add_with_match( ... match) |-> component_match_realloc(match, match->num); // dereference Add IS_ERR() check to prevent the crash. Found by Linux Verification Center (linuxtesting.org) with SVACE.
Ubuntu
Linux kernel (Azure) vulnerabilities
vendor_ubuntu·2026-02-24
CVE-2025-40175 Linux kernel (Azure) vulnerabilities
Title: Linux kernel (Azure) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- MIPS architecture;
- Nios II architecture;
- PA-RISC architecture;
- RISC-V architecture;
- S390 architecture;
- Sun Sparc architecture;
- x86 architecture;
- Xtensa architecture;
- Block layer subsystem;
- Cryptographic API;
- Compute Acceleration Framework;
- ACPI drivers;
- Drivers core;
- Network block device driver;
- Bluetooth drivers;
- Bus devices;
- Hardware random number generator core;
- Character device driver;
- Clock framework and drivers;
- Data acquisition framewor
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-02-17
CVE-2025-40304 Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- MIPS architecture;
- Nios II architecture;
- PA-RISC architecture;
- RISC-V architecture;
- S390 architecture;
- Sun Sparc architecture;
- x86 architecture;
- Xtensa architecture;
- Block layer subsystem;
- Cryptographic API;
- Compute Acceleration Framework;
- ACPI drivers;
- Drivers core;
- Network block device driver;
- Bluetooth drivers;
- Bus devices;
- Hardware random number generator core;
- Character device driver;
- Clock framework and drivers;
- Data acquisition framework and dr
Ubuntu
Linux kernel (OEM) vulnerabilities
vendor_ubuntu·2026-02-17
CVE-2025-68242 Linux kernel (OEM) vulnerabilities
Title: Linux kernel (OEM) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- MIPS architecture;
- Nios II architecture;
- PA-RISC architecture;
- RISC-V architecture;
- S390 architecture;
- Sun Sparc architecture;
- x86 architecture;
- Xtensa architecture;
- Block layer subsystem;
- Cryptographic API;
- Compute Acceleration Framework;
- ACPI drivers;
- Drivers core;
- Network block device driver;
- Bluetooth drivers;
- Bus devices;
- Hardware random number generator core;
- Character device driver;
- Clock framework and drivers;
- Data acquisition framework
Ubuntu
Linux kernel (GCP) vulnerabilities
vendor_ubuntu·2026-02-12
CVE-2025-68242 Linux kernel (GCP) vulnerabilities
Title: Linux kernel (GCP) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- MIPS architecture;
- Nios II architecture;
- PA-RISC architecture;
- RISC-V architecture;
- S390 architecture;
- Sun Sparc architecture;
- x86 architecture;
- Xtensa architecture;
- Block layer subsystem;
- Cryptographic API;
- Compute Acceleration Framework;
- ACPI drivers;
- Drivers core;
- Network block device driver;
- Bluetooth drivers;
- Bus devices;
- Hardware random number generator core;
- Character device driver;
- Clock framework and drivers;
- Data acquisition framework
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-02-12
CVE-2025-40304 Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- MIPS architecture;
- Nios II architecture;
- PA-RISC architecture;
- RISC-V architecture;
- S390 architecture;
- Sun Sparc architecture;
- x86 architecture;
- Xtensa architecture;
- Block layer subsystem;
- Cryptographic API;
- Compute Acceleration Framework;
- ACPI drivers;
- Drivers core;
- Network block device driver;
- Bluetooth drivers;
- Bus devices;
- Hardware random number generator core;
- Character device driver;
- Clock framework and drivers;
- Data acquisition framework and dr
Red Hat
kernel: ALSA: hda: Fix missing pointer check in hda_component_manager_init function
vendor_redhat·2025-10-30
CVE-2025-40097 kernel: ALSA: hda: Fix missing pointer check in hda_component_manager_init function
kernel: ALSA: hda: Fix missing pointer check in hda_component_manager_init function
In the Linux kernel, the following vulnerability has been resolved:
ALSA: hda: Fix missing pointer check in hda_component_manager_init function
The __component_match_add function may assign the 'matchptr' pointer
the value ERR_PTR(-ENOMEM), which will subsequently be dereferenced.
The call stack leading to the error looks like this:
hda_component_manager_init
|-> component_match_add
|-> component_match_add_release
|-> __component_match_add ( ... ,**matchptr, ... )
|-> *matchptr = ERR_PTR(-ENOMEM); // assign
|-> component_master_add_with_match( ... match)
|-> component_match_realloc(match, match->num); // dereference
Add IS_ERR() check to prevent the crash.
Found by Linux Verification Center (linuxtesting.o
Microsoft
ALSA: hda: Fix missing pointer check in hda_component_manager_init function
vendor_msrc·2025-10-14·CVSS 5.5
CVE-2025-40097 [MEDIUM] ALSA: hda: Fix missing pointer check in hda_component_manager_init function
ALSA: hda: Fix missing pointer check in hda_component_manager_init function
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
Linux: Linux
Customer Action Required: Yes
Debian
CVE-2025-40097: linux - In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: ...
vendor_debian·2025
CVE-2025-40097 CVE-2025-40097: linux - In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: ...
In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: Fix missing pointer check in hda_component_manager_init function The __component_match_add function may assign the 'matchptr' pointer the value ERR_PTR(-ENOMEM), which will subsequently be dereferenced. The call stack leading to the error looks like this: hda_component_manager_init |-> component_match_add |-> component_match_add_release |-> __component_match_add ( ... ,**matchptr, ... ) |-> *matchptr = ERR_PTR(-ENOMEM); // assign |-> component_master_add_with_match( ... match) |-> component_match_realloc(match, match->num); // dereference Add IS_ERR() check to prevent the crash. Found by Linux Verification Center (linuxtesting.org) with SVACE.
Scope: local
bookworm: open
bullseye: resolved
forky: resolved (fixed
No detection rules found.
No public exploits indexed.
2025-10-30
Published