Security readout for executives and security teams
Plain-English summary
A Linux audio codec driver flaw can access memory outside an intended array when configuring certain SoundWire headphone-compressor ports. Successful abuse could compromise confidentiality, integrity, and availability, but the supplied scoring indicates an attacker first needs local access and low-level privileges.
Executive priority
Treat as a high-priority endpoint or device patching issue where affected audio hardware and untrusted local access coexist. It is less urgent for systems without the wcd937x codec path. No supplied evidence supports emergency response for active exploitation.
Technical view
In the wcd937x ASoC codec, HPHL_COMP and HPHR_COMP SoundWire ports may be set to zero. Subsequent logic can address element -1 of the port_map array, potentially causing memory corruption. CVSS 3.1 scores it 7.8: local, low complexity, low privileges, no user interaction, with high impact.
Likely exposure
Exposure appears limited to affected Linux kernels using the wcd937x audio codec path. The bundle lists versions including 6.11, 6.12.53, 6.17.3, and 6.18, but its version data is ambiguous. Confirm applicability through distribution or device-vendor guidance.
Exploitation context
The supplied CVSS vector describes local exploitation requiring low privileges, without user interaction. CISA KEV status is false, and the supplied sources provide no evidence of active exploitation. Exact triggering conditions and practical exploitability are not documented in the bundle.
Researcher notes
The vulnerable condition is an apparent port-index underflow: a zero port value leads to access of port_map[-1]. The sources characterize the result only as potential memory corruption. They do not establish a reliable privilege-escalation path, affected hardware inventory, or complete fixed-version boundaries.
Mitigation direction
- Apply the applicable vendor kernel update incorporating the referenced stable fix.
- Prioritize devices that use the wcd937x codec and permit untrusted local access.
- Restrict local account access until affected systems are updated.
- Consult distribution or device-vendor guidance for precise fixed-version mapping.
Validation and detection
- Inventory running kernel versions on systems with wcd937x audio hardware.
- Confirm whether the wcd937x codec driver is present or active.
- Compare installed kernels with vendor advisories and referenced stable fixes.
- After updating, verify systems boot normally and audio functions correctly.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-40045 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/abcd537aae3b84c6d10ad147e99a204bcb56b234CVE reference, Linux
- https://git.kernel.org/stable/c/1a1ca38392e7e896075afc8905ddaea525ed30f7CVE reference, Linux
- https://git.kernel.org/stable/c/66a940b1bf48a7095162688332d725ba160154ebCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.