CVE-2025-40045 ASoC: codecs: wcd937x: set the comp soundwire port correctly
A Linux kernel audio driver bug allows memory corruption via invalid array indexing, potentially enabling code execution or system crashes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-40045?
CVE-2025-40045 is a high-severity memory corruption vulnerability in Linux, published on 28 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ASoC: codecs: wcd937x: set the comp soundwire port correctly
For some reason we endup with setting soundwire port for HPHL_COMP and HPHR_COMP as zero, this can potentially result in a memory corruption due to accessing and setting -1 th element of port_map array.
Which versions are affected by CVE-2025-40045?
How do I fix CVE-2025-40045?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-40045 being exploited?
There is no known exploitation of CVE-2025-40045 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2025-40045, DEBIAN-CVE-2025-40045, GHSA-vvjm-j2jq-pjc2, ROOT-OS-DEBIAN-13-CVE-2025-40045, UBUNTU-CVE-2025-40045.