CVE-2025-40085

ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card

State: Published
Severity: Not scored
Published: Oct 29, 2025
Updated: May 23, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card

In try_to_register_card(), the return value of usb_ifnum_to_if() is passed directly to usb_interface_claimed() without a NULL check, which will lead to a NULL pointer dereference when creating an invalid USB audio device. Fix this by adding a check to ensure the interface pointer is valid before passing it to usb_interface_claimed().

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	28787ff9fbeaf57684eb64cc33e2ec8ceedf21b5 to before 736159f7b296d7a95f7208eb4799639b1f8b16a0Affected 39efc9c8a973ddff5918191525d1679d0fb368ea to before 8d19a7ab28c7b9c207db5c5282afa8cc8595bcdbAffected 39efc9c8a973ddff5918191525d1679d0fb368ea to before 576312eb436326b44b7010f4d9ae2b698df075eaAffected 39efc9c8a973ddff5918191525d1679d0fb368ea to before bba7208765d26e5e36b87f21dacc2780b064f41fAffected 39efc9c8a973ddff5918191525d1679d0fb368ea to before 8503ac1a62075a085402e42a386b5c627c821a51Affected 39efc9c8a973ddff5918191525d1679d0fb368ea to before 28412b489b088fb88dff488305fd4e56bd47f6e4Affected 9d4f4dc3cd38e412c29a7626489fe48b79ebbf6cAffected 52076a41c128146c9df4a157e972cb17019313b1Affected 5.15.75 to before 5.15.196Affected 5.19.17 to before 5.20Affected 6.0.3 to before 6.1Affected
LinuxLinux	6.1Affected before 6.1Not affected 5.15.196 through 5.15.Not affected 6.1.158 through 6.1.Not affected 6.6.114 through 6.6.Not affected 6.12.55 through 6.12.Not affected 6.17.5 through 6.17.*Not affected 6.18 and laterNot affected

Product

Versions

LinuxLinux

28787ff9fbeaf57684eb64cc33e2ec8ceedf21b5 to before 736159f7b296d7a95f7208eb4799639b1f8b16a0Affected
39efc9c8a973ddff5918191525d1679d0fb368ea to before 8d19a7ab28c7b9c207db5c5282afa8cc8595bcdbAffected
39efc9c8a973ddff5918191525d1679d0fb368ea to before 576312eb436326b44b7010f4d9ae2b698df075eaAffected
39efc9c8a973ddff5918191525d1679d0fb368ea to before bba7208765d26e5e36b87f21dacc2780b064f41fAffected
39efc9c8a973ddff5918191525d1679d0fb368ea to before 8503ac1a62075a085402e42a386b5c627c821a51Affected
39efc9c8a973ddff5918191525d1679d0fb368ea to before 28412b489b088fb88dff488305fd4e56bd47f6e4Affected
9d4f4dc3cd38e412c29a7626489fe48b79ebbf6cAffected
52076a41c128146c9df4a157e972cb17019313b1Affected
5.15.75 to before 5.15.196Affected
5.19.17 to before 5.20Affected
6.0.3 to before 6.1Affected

LinuxLinux

6.1Affected
before 6.1Not affected
5.15.196 through 5.15.*Not affected
6.1.158 through 6.1.*Not affected
6.6.114 through 6.6.*Not affected
6.12.55 through 6.12.*Not affected
6.17.5 through 6.17.*Not affected
6.18 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.