CVE-2025-40207: linux

CVSS: UnknownDeferred
AliasesUBUNTU-CVE-2025-40207DEBIAN-CVE-2025-40207
Published 12-11-2025Last modified 11-05-2026
Open JSON

Vulnerability summary

CVE-2025-40207 is a vulnerability in linux with no CVSS score yet. EPSS estimates a 0.20% chance of exploitation in the next 30 days, higher than 9.1% of scored vulnerabilities.

Overall risk
0/100
0100
Minimal · default modelHow is this calculated?
CVSS score
Not scored
010
No CVSS score recorded
EPSS score
0.20%
0%100%
Low · +0.01 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 31 · Related 30
DLA-4379-1OPENSUSE-SU-2025:20172-1SUSE-SU-2025:4393-1SUSE-SU-2025:4422-1SUSE-SU-2025:4505-1SUSE-SU-2025:4516-1

Timeline

  1. 12-11-2025
    PublishedVulnerability first disclosed.
  2. 11-05-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() v4l2_subdev_call_state_try() macro allocates a subdev state with __v4l2_subdev_state_alloc(), but does not check the returned value. If __v4l2_subdev_state_alloc fails, it returns an ERR_PTR, and that would cause v4l2_subdev_call_state_try() to crash. Add proper error handling to v4l2_subdev_call_state_try().

CVSS metrics

Risk metrics not yet published.

EPSS trend

Probability

0.20%

Chance of exploitation in the next 30 days

Percentile

9%

Versus all other CVEs

30-day change

+0.01 pp

From 0.19% on 21-09-2026

21-09-202621-10-2026
EPSS score
0.20%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu127 products
  • linux< 6.8.0-106.106 | < 6.17.0-14.14
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-aws< 6.8.0-1050.53 | < 6.17.0-1007.7
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian1 product
  • linux< 6.1.158-1 | < 6.12.57-1 | < 6.17.6-1
Linux1 product
  • linux≥ 982c0487185bd466059ff618f398a8d074ddb654, < 5b0057459cdc243ffb35617603142dcace09c711 | ≥ 982c0487185bd466059ff618f398a8d074ddb654, < ed30811fbed40751deb952bde534aa2632dc0bf7 | ≥ 982c0487185bd466059ff618f398a8d074ddb654, < 94e6336dc1f06a06f5b4cd04d4a012bba34f2857 | ≥ 982c0487185bd466059ff618f398a8d074ddb654, < a553530b3314a0bdc98cf114cdbe204551a70a00 | ≥ 982c0487185bd466059ff618f398a8d074ddb654, < f37df9a0eb5e43fcfe02cbaef076123dc0d79c7e | 6.0

3 vendors · 129 products

References

25 links
Show all 25 references