GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-40045 (GCVE-0-2025-40045)

Vulnerability from cvelistv5 – Published: 2025-10-28 11:48 – Updated: 2026-08-05 12:07
VLAI
Title
ASoC: codecs: wcd937x: set the comp soundwire port correctly
Summary
In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: wcd937x: set the comp soundwire port correctly For some reason we endup with setting soundwire port for HPHL_COMP and HPHR_COMP as zero, this can potentially result in a memory corruption due to accessing and setting -1 th element of port_map array.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 82be8c62a38c6a44e64ecb29d7a9b5cb35c6cad4 , < abcd537aae3b84c6d10ad147e99a204bcb56b234 (git)
Affected: 82be8c62a38c6a44e64ecb29d7a9b5cb35c6cad4 , < 1a1ca38392e7e896075afc8905ddaea525ed30f7 (git)
Affected: 82be8c62a38c6a44e64ecb29d7a9b5cb35c6cad4 , < 66a940b1bf48a7095162688332d725ba160154eb (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.11
Unaffected: 0 , < 6.11 (semver)
Unaffected: 6.12.53 , ≤ 6.12.* (semver)
Unaffected: 6.17.3 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/soc/codecs/wcd937x.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "abcd537aae3b84c6d10ad147e99a204bcb56b234",
              "status": "affected",
              "version": "82be8c62a38c6a44e64ecb29d7a9b5cb35c6cad4",
              "versionType": "git"
            },
            {
              "lessThan": "1a1ca38392e7e896075afc8905ddaea525ed30f7",
              "status": "affected",
              "version": "82be8c62a38c6a44e64ecb29d7a9b5cb35c6cad4",
              "versionType": "git"
            },
            {
              "lessThan": "66a940b1bf48a7095162688332d725ba160154eb",
              "status": "affected",
              "version": "82be8c62a38c6a44e64ecb29d7a9b5cb35c6cad4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/soc/codecs/wcd937x.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.53",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.3",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: codecs: wcd937x: set the comp soundwire port correctly\n\nFor some reason we endup with setting soundwire port for\nHPHL_COMP and HPHR_COMP as zero, this can potentially result\nin a memory corruption due to accessing and setting -1 th element of\nport_map array."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only through an ALSA control-element write ioctl (SNDRV_CTL_IOCTL_ELEM_WRITE) on /dev/snd/controlC*, which requires local access to the device node. There is no network or remote-peer input path into wcd937x_set_compander().\nAC:L - A single ioctl writing a toggled value to \"HPHL_COMP Switch\" or \"HPHR_COMP Switch\" deterministically drives mc-\u003ereg == -1 into the ch_info[] index and the u8 truncation to 255, with no race, timing window, or unpredictable precondition. The out-of-bounds indices and written values derive from fixed module .data content, so they are identical on every boot of a given build.\nPR:L - No capability check exists on the path; the attacker only needs write access to the sound card\u0027s control node, which unprivileged desktop/embedded users hold via the audio group or logind ACLs and which the audio HAL holds on Android. Per the higher-severity rule this is Low rather than High.\nUI:N - The attacker performs the control write entirely on its own; no victim must open a file, mount anything, or interact with audio in any way. The codec controls are registered as soon as the WCD937x component probes.\nS:U - The out-of-bounds accesses corrupt kernel heap memory within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The path performs multiple unbounded reads \u2014 ch_info[-1], ch_info[255] roughly 3 KB past a 96-byte array, and sdw_slave-\u003em_port_map[] indexed by an attacker-unbounded u8 \u2014 and the resulting heap out-of-bounds writes constitute memory corruption that can be leveraged for arbitrary read, so High applies.\nI:H - Two out-of-bounds writes occur past the small devm_kzalloc\u0027d wcd937x_sdw_priv object (port_config[port_idx-1].num up to ~2 KB beyond, master_channel_map[mstr_port_num] up to ~1 KB beyond), corrupting adjacent slab objects with build-deterministic offsets \u2014 a heap write primitive suitable for control-flow hijacking.\nA:H - Out-of-bounds slab writes corrupt neighbouring allocations and readily produce KASAN reports, slab metadata damage, and kernel oops/panic; the far OOB read may also touch unmapped memory. Any kernel crash is scored High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:07:18.382Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/abcd537aae3b84c6d10ad147e99a204bcb56b234"
        },
        {
          "url": "https://git.kernel.org/stable/c/1a1ca38392e7e896075afc8905ddaea525ed30f7"
        },
        {
          "url": "https://git.kernel.org/stable/c/66a940b1bf48a7095162688332d725ba160154eb"
        }
      ],
      "title": "ASoC: codecs: wcd937x: set the comp soundwire port correctly",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40045",
    "datePublished": "2025-10-28T11:48:23.431Z",
    "dateReserved": "2025-04-16T07:20:57.154Z",
    "dateUpdated": "2026-08-05T12:07:18.382Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-40045",
      "date": "2026-09-17",
      "epss": "0.00152",
      "percentile": "0.04772"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-40045\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-10-28T12:15:38.577\",\"lastModified\":\"2026-07-30T06:24:07.957\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nASoC: codecs: wcd937x: set the comp soundwire port correctly\\n\\nFor some reason we endup with setting soundwire port for\\nHPHL_COMP and HPHR_COMP as zero, this can potentially result\\nin a memory corruption due to accessing and setting -1 th element of\\nport_map array.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"sound/soc/codecs/wcd937x.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"82be8c62a38c6a44e64ecb29d7a9b5cb35c6cad4\",\"lessThan\":\"abcd537aae3b84c6d10ad147e99a204bcb56b234\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"82be8c62a38c6a44e64ecb29d7a9b5cb35c6cad4\",\"lessThan\":\"1a1ca38392e7e896075afc8905ddaea525ed30f7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"82be8c62a38c6a44e64ecb29d7a9b5cb35c6cad4\",\"lessThan\":\"66a940b1bf48a7095162688332d725ba160154eb\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"sound/soc/codecs/wcd937x.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.53\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17.3\",\"lessThanOrEqual\":\"6.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1a1ca38392e7e896075afc8905ddaea525ed30f7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/66a940b1bf48a7095162688332d725ba160154eb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/abcd537aae3b84c6d10ad147e99a204bcb56b234\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:15:37+00:00",
      "cve": "CVE-2025-40045",
      "id": "CVE-2025-40045",
      "initial_release_date": "2025-10-28T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ASoC: codecs: wcd937x: set the comp soundwire port correctly",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40045.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.