CVE-2025-40085: linux

CVSS: UnknownDeferred
AliasesUBUNTU-CVE-2025-40085DEBIAN-CVE-2025-40085
Published 29-10-2025Last modified 23-05-2026
Open JSON

Vulnerability summary

CVE-2025-40085 is a vulnerability in linux with no CVSS score yet. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 10.1% of scored vulnerabilities.

Overall risk
0/100
0100
Minimal · default modelHow is this calculated?
CVSS score
Not scored
010
No CVSS score recorded
EPSS score
0.21%
0%100%
Low · +0.01 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 50 · Related 46
DLA-4379-1DSA-6053-1MGASA-2025-0309MGASA-2025-0310OPENSUSE-SU-2025:15702-1OPENSUSE-SU-2025:20091-1

Timeline

  1. 29-10-2025
    PublishedVulnerability first disclosed.
  2. 23-05-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card In try_to_register_card(), the return value of usb_ifnum_to_if() is passed directly to usb_interface_claimed() without a NULL check, which will lead to a NULL pointer dereference when creating an invalid USB audio device. Fix this by adding a check to ensure the interface pointer is valid before passing it to usb_interface_claimed().

CVSS metrics

Risk metrics not yet published.

EPSS trend

Probability

0.21%

Chance of exploitation in the next 30 days

Percentile

10%

Versus all other CVEs

30-day change

+0.01 pp

From 0.19% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.21%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu141 products
  • linux< 5.15.0-170.180 | < 6.8.0-106.106 | < 6.17.0-14.14
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-aws< 5.15.0-1100.107 | < 6.8.0-1050.53 | < 6.17.0-1007.7
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian1 product
  • linux< 6.1.158-1 | < 6.12.57-1 | < 6.17.6-1
Linux1 product
  • linux≥ 28787ff9fbeaf57684eb64cc33e2ec8ceedf21b5, < 736159f7b296d7a95f7208eb4799639b1f8b16a0 | ≥ 39efc9c8a973ddff5918191525d1679d0fb368ea, < 8d19a7ab28c7b9c207db5c5282afa8cc8595bcdb | ≥ 39efc9c8a973ddff5918191525d1679d0fb368ea, < 576312eb436326b44b7010f4d9ae2b698df075ea | ≥ 39efc9c8a973ddff5918191525d1679d0fb368ea, < bba7208765d26e5e36b87f21dacc2780b064f41f | ≥ 39efc9c8a973ddff5918191525d1679d0fb368ea, < 8503ac1a62075a085402e42a386b5c627c821a51 | ≥ 39efc9c8a973ddff5918191525d1679d0fb368ea, < 28412b489b088fb88dff488305fd4e56bd47f6e4 | 9d4f4dc3cd38e412c29a7626489fe48b79ebbf6c | 52076a41c128146c9df4a157e972cb17019313b1 | ≥ 5.15.75, < 5.15.196 | ≥ 5.19.17, < 5.20 | ≥ 6.0.3, < 6.1 | 6.1

3 vendors · 143 products

References

40 links
Show all 40 references