CVE-2025-40207: Linux

EPSS: 0.2% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() v4l2_subdev_call_state_try() macro allocates a subdev state with __v4l2_subdev_state_alloc(), but does not check the returned value. If __v4l2_subdev_state_alloc fails, it returns an ERR_PTR, and that would cause v4l2_subdev_call_state_try() to crash. Add proper error handling to v4l2_subdev_call_state_try().

Affected products

• Linux Linux: from 6.0, before 6.1.157 (fixed in 6.1.157); from 6.2, before 6.6.113 (fixed in 6.6.113); from 6.7, before 6.12.54 (fixed in 6.12.54); from 6.13, before 6.17.4 (fixed in 6.17.4)

Published 2025-11-12. Last modified 2026-06-17.