CVE-2025-40162

A flaw was found in the Linux kernel's AMD SoundWire utilities in the ASoC subsystem. In the sdw_utils code, devm_kasprintf() may return NULL on memory allocation failure. However, a debug message attempts to print the cpus->dai_name value before the NULL check is performed. If memory allocation fails, this results in a NULL pointer dereference. While this typically requires memory pressure to trigger, it could cause a kernel crash during audio device initialization.

This vulnerability requires memory pressure conditions to trigger the allocation failure. The impact is limited to denial of service during audio subsystem initialization on systems with AMD SoundWire audio hardware. The CVSS score reflects the low availability impact and the difficulty of triggering the condition.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the snd_soc_amd_sdw_mach module from being loaded if AMD SoundWire audio functionality is not required. See https://access.redhat.com/solutions/41278 for instructions on how to blacklist a kernel module.