CVE-2025-40156: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability was discovered in the Linux kernel's PM/devfreq MTK-CCI component, identified as CVE-2025-40156. The issue was disclosed on November 12, 2025, affecting the Linux kernel's power management subsystem. The vulnerability involves a potential error pointer dereference in the probe() function where the drv->sram_reg pointer could be set to ERR_PTR(-EPROBE_DEFER) (NVD, Ubuntu).

The vulnerability stems from improper pointer validation in the MTK-CCI (MediaTek Cache Coherent Interconnect) driver's probe function. Specifically, the drv->sram_reg pointer could be dereferenced without proper validation when it contains an error value ERR_PTR(-EPROBE_DEFER). The correct fix involves using IS_ERR_OR_NULL() to properly check that the pointer is valid before dereferencing (NVD).

The vulnerability affects various Linux distributions and kernel versions, particularly impacting systems using the MTK-CCI driver. Several Ubuntu releases including 24.04 LTS noble, 25.10 questing, and various kernel variants (linux-azure, linux-gcp, linux-aws) are marked as vulnerable (Ubuntu).

The vulnerability has been fixed by implementing proper pointer validation using IS_ERR_OR_NULL() check before dereferencing the drv->sram_reg pointer. Users are advised to update their systems to patched versions when available (NVD).