CVE-2025-40154 — Out-of-bounds Read in Linux

CWE-125 — Out-of-bounds Read54 documents6 sources
Severity
7.8HIGHOSV
OSV5.5OSV3.2
No vector
EPSS
0.0%
top 87.20%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
LinuxLinux KernelDebian Linux+1 more
Timeline
PublishedNov 12
Latest updateApr 13

Description

In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping When an invalid value is passed via quirk option, currently bytcr_rt5640 driver only shows an error message but leaves as is. This may lead to unepxected results like OOB access. This patch corrects the input mapping to the certain default value if an invalid value is passed.

Affected Packages6 packages

▶Linuxlinux/linux_kernel4.18.0 — 5.4.301+6
▶Debianlinux/linux_kernel< 5.10.247-1+3
▶Ubuntulinux/linux_kernel< 5.15.0-170.180+2
▶CVEListV5linux/linux063422ca2a9de238401c3848c1b3641c07b6316c — 2c27e047bdcba457ec953f7e90e4ed6d5f8aeb01+8
▶debiandebian/linux< linux 6.1.158-1 (bookworm)

🔴Vulnerability Details

27
OSV
linux-raspi vulnerabilities↗2026-04-01
▶
OSV
linux-raspi, linux-raspi-realtime vulnerabilities↗2026-04-01
▶
OSV
linux-azure-6.8 vulnerabilities↗2026-03-25
▶
OSV
linux-azure vulnerabilities↗2026-03-25
▶
OSV
linux-aws-6.8 vulnerabilities↗2026-03-23
▶

📋Vendor Advisories

26
Ubuntu
Linux kernel (Azure) vulnerabilities↗2026-04-13
▶
Ubuntu
Linux kernel (Azure FIPS) vulnerabilities↗2026-04-09
▶
Ubuntu
Linux kernel (Azure FIPS) vulnerabilities↗2026-04-09
▶
Ubuntu
Linux kernel (Raspberry Pi) vulnerabilities↗2026-04-01
▶
Ubuntu
Linux kernel (Raspberry Pi) vulnerabilities↗2026-04-01
▶