BaseFortify

Publication date: 2025-11-12

Last updated on: 2025-11-14

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() v4l2_subdev_call_state_try() macro allocates a subdev state with __v4l2_subdev_state_alloc(), but does not check the returned value. If __v4l2_subdev_state_alloc fails, it returns an ERR_PTR, and that would cause v4l2_subdev_call_state_try() to crash. Add proper error handling to v4l2_subdev_call_state_try().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-12

Last Modified

2025-11-14

Generated

2026-07-06

AI Q&A

2025-11-13

EPSS Evaluated

2026-07-05

NVD

CVE-2025-40207

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's media subsystem, specifically in the v4l2-subdev component. The macro v4l2_subdev_call_state_try() allocates a sub-device state using __v4l2_subdev_state_alloc(), but it does not check if the allocation was successful. If the allocation fails, __v4l2_subdev_state_alloc() returns an error pointer (ERR_PTR), which causes v4l2_subdev_call_state_try() to crash. The fix involves adding proper error handling to prevent this crash.

Impact Analysis

This vulnerability can cause the Linux kernel to crash when the v4l2_subdev_call_state_try() macro encounters a failed allocation and does not handle the error properly. Such a crash can lead to system instability or denial of service, affecting the availability of the system or services relying on the media subsystem.

Hi! I’m here to help you understand CVE-2025-40207. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70