Memory Management Flaw in Linux Kernel Affects Sensor Drivers

CVE-2025-40224

What is CVE-2025-40224?

A vulnerability has been identified in the Linux kernel related to the hwmon subsystem, specifically within the cgbc-hwmon driver. The vulnerability arises due to a lack of proper checks after the memory allocation using devm_kzalloc(). If the allocation fails, the existing logic does not handle this scenario, potentially leading to dereferencing a NULL pointer and causing a kernel crash. The issue has been addressed by implementing a NULL pointer check to ensure that memory allocation failures are handled gracefully, returning -ENOMEM in such cases.

References