CVE-2025-40097

ALSA: hda: Fix missing pointer check in hda_component_manager_init function

State
Published
Severity
Not scored
Published
Oct 30, 2025
Updated
Oct 3, 2026
Reserved
Apr 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: hda: Fix missing pointer check in hda_component_manager_init function

The __component_match_add function may assign the 'matchptr' pointer the value ERR_PTR(-ENOMEM), which will subsequently be dereferenced.

The call stack leading to the error looks like this:

hda_component_manager_init |-> component_match_add |-> component_match_add_release |-> __component_match_add ( ... ,**matchptr, ... ) |-> *matchptr = ERR_PTR(-ENOMEM); // assign |-> component_master_add_with_match( ... match) |-> component_match_realloc(match, match->num); // dereference

Add IS_ERR() check to prevent the crash.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • ae7abe36e352eddf8e30d3b1ea3fb402514ba13b to before b044aa6ae63391ba40c93ca5d476d276cb17db1bAffected
  • ae7abe36e352eddf8e30d3b1ea3fb402514ba13b to before 1c3f4b15eb1850558d7d4da74b98cffbb8121721Affected
  • ae7abe36e352eddf8e30d3b1ea3fb402514ba13b to before 218a8504e62fc2c8a1fd12523346b7a2b9bd2474Affected
  • ae7abe36e352eddf8e30d3b1ea3fb402514ba13b to before 47d1b9ca923b55c3f407788f1f15b04957e0e027Affected
  • ae7abe36e352eddf8e30d3b1ea3fb402514ba13b to before 1cf11d80db5df805b538c942269e05a65bcaf5bcAffected
LinuxLinux
  • 5.17Affected
  • before 5.17Not affected
  • 6.1.189 through 6.1.*Not affected
  • 6.6.158 through 6.6.*Not affected
  • 6.12.59 through 6.12.*Not affected
  • 6.17.5 through 6.17.*Not affected
  • 6.18 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.