Linux Kernel Vulnerability in V4L2 Sub-device Error Handling

CVE-2025-40207

What is CVE-2025-40207?

A vulnerability exists in the Linux kernel's media subsystem, specifically within the v4l2_subdev_call_state_try() macro. This vulnerability arises from inadequate error checking when allocating a sub-device state using __v4l2_subdev_state_alloc(). When this allocation fails and inadvertently returns an ERR_PTR, it can lead to a crash of the v4l2_subdev_call_state_try() function. The issue has been addressed with improved error handling to ensure that allocation failures are properly managed, preventing potential system instability.

References