CVE-2025-40162 ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails
A NULL pointer dereference in the Linux kernel AMD SoundWire driver can cause a system crash if memory allocation fails during debug logging.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-40162?
CVE-2025-40162 is a vulnerability in Linux, published on 12 Nov 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails
devm_kasprintf() may return NULL on memory allocation failure, but the debug message prints cpus->dai_name before checking it. Move the dev_dbg() call after the NULL check to prevent potential NULL pointer dereference.
Which versions are affected by CVE-2025-40162?
How do I fix CVE-2025-40162?
Apply the vendor's patch.
Is CVE-2025-40162 being exploited?
There is no known exploitation of CVE-2025-40162 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2025-40162, DEBIAN-CVE-2025-40162, GHSA-rgxq-f336-55c2, UBUNTU-CVE-2025-40162.