CVE-2025-40207
In the Linux kernel, the following vulnerability has been resolved: media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() v4l2_subdev_call_state_try() macro allocates a subdev state with __v4l2_subdev_state_alloc(), but does not check the returned value. If __v4l2_subdev_state_alloc fails, it returns an ERR_PTR, and that would cause v4l2_subdev_call_state_try() to crash. Add proper error handling to v4l2_subdev_call_state_try().
Affected versions
Linux kernel versions
6.0
and later are affected. Fixed in
6.1.157,
6.6.113,
6.12.54,
6.17.4,
6.18
and their respective stable series.
References
The following references provide additional information about CVE-2025-40207 including vendor advisories, patch commits, exploit details, and third-party analysis. Links are sourced from the NIST NVD database.
-
PatchKernel patch commithttps://git.kernel.org/stable/c/5b0057459cdc243ffb35617603142dcace09c711
-
PatchKernel patch commithttps://git.kernel.org/stable/c/94e6336dc1f06a06f5b4cd04d4a012bba34f2857
-
PatchKernel patch commithttps://git.kernel.org/stable/c/a553530b3314a0bdc98cf114cdbe204551a70a00
Frequently asked questions
-
What is CVE-2025-40207?
CVE-2025-40207 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.0 onward and has been patched in 6.1.157, 6.6.113, 6.12.54 and others. CVE-2025-40207 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2025-40207?
Yes — CVE-2025-40207 has been patched. Fixed versions include 6.1.157, 6.6.113, 6.12.54 and others. If you are running Linux kernel 6.0 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2025-40207 actively exploited?
No — CVE-2025-40207 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.