CVE-2025-40224 hwmon: (cgbc-hwmon) Add missing NULL check after devm_kzalloc()
A missing NULL check in the cgbc-hwmon driver can cause a kernel crash upon memory allocation failure, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-40224?
CVE-2025-40224 is a vulnerability in Linux, published on 4 Dec 2025.
Official description
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (cgbc-hwmon) Add missing NULL check after devm_kzalloc()
The driver allocates memory for sensor data using devm_kzalloc(), but did not check if the allocation succeeded. In case of memory allocation failure, dereferencing the NULL pointer would lead to a kernel crash.
Add a NULL pointer check and return -ENOMEM to handle allocation failure properly.
Which versions are affected by CVE-2025-40224?
How do I fix CVE-2025-40224?
Apply the vendor's patch.
Is CVE-2025-40224 being exploited?
There is no known exploitation of CVE-2025-40224 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2025-40224, DEBIAN-CVE-2025-40224, GHSA-gw2c-4fx4-rq5x, UBUNTU-CVE-2025-40224.