Answer in brief
CVE-2025-40098 records a Unknown severity vulnerability in ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=447106e92a0c86c332d40710436f38f64c322cd6 <19129a365d2bd019fb60662b36b2655931997f12 || >=447106e92a0c86c332d40710436f38f64c322cd6 <b518386db2b993d786c431caa9f46ce063c5cb05 || >=447106e92a0c86c332d40710436f38f64c322cd6 <8527bbb33936340525a3504a00932b2f8fd75754 | 19129a365d2bd019fb60662b36b2655931997f12, b518386db2b993d786c431caa9f46ce063c5cb05, 8527bbb33936340525a3504a00932b2f8fd75754 |
| Linux/Linuxgeneric | 6.7 | Not reported |
Published upstream
Oct 30, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 3, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 3, 2026
In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() Return value of a function acpi_evaluate_dsm() is dereferenced without checking for NULL, but it is usually checked for this function. acpi_evaluate_dsm() may return NULL, when acpi_evaluate_object() returns acpi_status other than ACPI_SUCCESS, so add a check to prevent the crach. Found by Linux Verification Center (linuxtesting.org) with SVACE.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2025-40098 records a Unknown severity vulnerability in ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=447106e92a0c86c332d40710436f38f64c322cd6 <19129a365d2bd019fb60662b36b2655931997f12 || >=447106e92a0c86c332d40710436f38f64c322cd6 <b518386db2b993d786c431caa9f46ce063c5cb05 || >=447106e92a0c86c332d40710436f38f64c322cd6 <8527bbb33936340525a3504a00932b2f8fd75754 | 19129a365d2bd019fb60662b36b2655931997f12, b518386db2b993d786c431caa9f46ce063c5cb05, 8527bbb33936340525a3504a00932b2f8fd75754 |
| Linux/Linuxgeneric | 6.7 | Not reported |
Published upstream
Oct 30, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 3, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 3, 2026
In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() Return value of a function acpi_evaluate_dsm() is dereferenced without checking for NULL, but it is usually checked for this function. acpi_evaluate_dsm() may return NULL, when acpi_evaluate_object() returns acpi_status other than ACPI_SUCCESS, so add a check to prevent the crach. Found by Linux Verification Center (linuxtesting.org) with SVACE.
Quoted source text, attributed separately from HOL analysis.