Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-40317— regmap: slimbus: fix bus_context pointer in regmap init calls

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于总线上下文指针错误，可能导致内存损坏。

CVSS 7.8 · High EPSS 0.14% · P3

Possible ATT&CK Techniques 1 AI

T1059 · Command and Scripting Interpreter

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 7d6f7fb053ad543da74119df3c4cd7bb46220471< c0f05129e5734ff3fd14b2c242709314d9ca5433 affected
7d6f7fb053ad543da74119df3c4cd7bb46220471< 02d3041caaa3fe4dd69e5a8afd1ac6b918ddc6a1 affected
7d6f7fb053ad543da74119df3c4cd7bb46220471< d979639f099c6e51f06ce4dd8d8e56364d6c17ba affected
7d6f7fb053ad543da74119df3c4cd7bb46220471< 8143e4075d131c528540417a51966f6697be14eb affected
7d6f7fb053ad543da74119df3c4cd7bb46220471< 2664bfd8969d1c43dcbe3ea313f130dfa6b74f4c affected
7d6f7fb053ad543da74119df3c4cd7bb46220471< a16e92f8d7dc7371e68f17a9926cb92d2244be7b affected
7d6f7fb053ad543da74119df3c4cd7bb46220471< b65f3303349eaee333e47d2a99045aa12fa0c3a7 affected
7d6f7fb053ad543da74119df3c4cd7bb46220471< 434f7349a1f00618a620b316f091bd13a12bc8d2 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-40317

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
regmap: slimbus: fix bus_context pointer in regmap init calls
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: regmap: slimbus: fix bus_context pointer in regmap init calls Commit 4e65bda8273c ("ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()") revealed the problem in the slimbus regmap. That commit breaks audio playback, for instance, on sdm845 Thundercomm Dragonboard 845c board: Unable to handle kernel paging request at virtual address ffff8000847cbad4 ... CPU: 5 UID: 0 PID: 776 Comm: aplay Not tainted 6.18.0-rc1-00028-g7ea30958b305 #11 PREEMPT Hardware name: Thundercomm Dragonboard 845c (DT) ... Call trace: slim_xfer_msg+0x24/0x1ac [slimbus] (P) slim_read+0x48/0x74 [slimbus] regmap_slimbus_read+0x18/0x24 [regmap_slimbus] _regmap_raw_read+0xe8/0x174 _regmap_bus_read+0x44/0x80 _regmap_read+0x60/0xd8 _regmap_update_bits+0xf4/0x140 _regmap_select_page+0xa8/0x124 _regmap_raw_write_impl+0x3b8/0x65c _regmap_bus_raw_write+0x60/0x80 _regmap_write+0x58/0xc0 regmap_write+0x4c/0x80 wcd934x_hw_params+0x494/0x8b8 [snd_soc_wcd934x] snd_soc_dai_hw_params+0x3c/0x7c [snd_soc_core] __soc_pcm_hw_params+0x22c/0x634 [snd_soc_core] dpcm_be_dai_hw_params+0x1d4/0x38c [snd_soc_core] dpcm_fe_dai_hw_params+0x9c/0x17c [snd_soc_core] snd_pcm_hw_params+0x124/0x464 [snd_pcm] snd_pcm_common_ioctl+0x110c/0x1820 [snd_pcm] snd_pcm_ioctl+0x34/0x4c [snd_pcm] __arm64_sys_ioctl+0xac/0x104 invoke_syscall+0x48/0x104 el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x34/0xec el0t_64_sync_handler+0xa0/0xf0 el0t_64_sync+0x198/0x19c The __devm_regmap_init_slimbus() started to be used instead of __regmap_init_slimbus() after the commit mentioned above and turns out the incorrect bus_context pointer (3rd argument) was used in __devm_regmap_init_slimbus(). It should be just "slimbus" (which is equal to &slimbus->dev). Correct it. The wcd934x codec seems to be the only or the first user of devm_regmap_init_slimbus() but we should fix it till the point where __devm_regmap_init_slimbus() was introduced therefore two "Fixes" tags. While at this, also correct the same argument in __regmap_init_slimbus().
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于总线上下文指针错误，可能导致内存损坏。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 7d6f7fb053ad543da74119df3c4cd7bb46220471 ~ c0f05129e5734ff3fd14b2c242709314d9ca5433 -
Linux Linux 4.16 -

II. Public POCs for CVE-2025-40317

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-40317

请登录查看更多情报信息。

Same Patch Batch · Linux · 2025-12-08 · 82 CVEs total

CVE-2023-53751 9.8 CRITICAL cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname
CVE-2025-40320 9.8 CRITICAL smb: client: fix potential cfid UAF in smb2_query_info_compound
CVE-2023-53769 9.3 CRITICAL virt/coco/sev-guest: Double-buffer messages
CVE-2025-40318 8.8 HIGH Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once
CVE-2023-53764 8.8 HIGH wifi: ath12k: Handle lock during peer_id find
CVE-2023-53762 8.8 HIGH Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync
CVE-2025-40292 8.4 HIGH virtio-net: fix received length check in big packets
CVE-2025-40309 8.0 HIGH Bluetooth: SCO: Fix UAF on sco_conn_free
CVE-2025-40323 7.8 HIGH fbcon: Set fb_display[i]->mode to NULL when the mode is released
CVE-2023-53747 7.8 HIGH vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF
CVE-2023-53753 7.8 HIGH drm/amd/display: fix mapping to non-allocated address
CVE-2025-40319 7.8 HIGH bpf: Sync pending IRQ work before freeing ring buffer
CVE-2023-53763 7.8 HIGH Revert "f2fs: fix to do sanity check on extent cache correctly"
CVE-2023-53759 7.8 HIGH HID: hidraw: fix data race on device refcount
CVE-2022-50623 7.8 HIGH fpga: prevent integer overflow in dfl_feature_ioctl_set_irq()
CVE-2023-53752 7.8 HIGH net: deal with integer overflows in kmalloc_reserve()
CVE-2022-50630 7.8 HIGH mm: hugetlb: fix UAF in hugetlb_handle_userfault
CVE-2025-40297 7.8 HIGH net: bridge: fix use-after-free due to MST port state bypass
CVE-2023-53768 7.8 HIGH regmap-irq: Fix out-of-bounds access when allocating config buffers
CVE-2025-40302 7.8 HIGH media: videobuf2: forbid remove_bufs when legacy fileio is active

Showing top 20 of 82 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-40317

No comments yet

Leave a comment