CVE-2025-40317: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40317 is a Linux kernel vulnerability in the regmap slimbus subsystem caused by an incorrect bus_context pointer in regmap initialization calls. The flaw was surfaced by commit 4e65bda8273c ("ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()"), which caused __devm_regmap_init_slimbus() to be used with a wrong third argument, triggering kernel paging faults during audio playback. Affected platforms include devices using the WCD934x codec over SlimBus (e.g., Qualcomm SDM845-based Thundercomm Dragonboard 845c). It was disclosed on December 8, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is an incorrect pointer argument passed to __devm_regmap_init_slimbus() — the bus_context (3rd argument) was set to the wrong value instead of slimbus (i.e., &slimbus->dev). This is classified as CWE-822 (Untrusted Pointer Dereference) or more broadly an improper initialization issue. When audio playback is initiated (e.g., via aplay), the kernel attempts to perform SlimBus register map reads/writes using the invalid pointer, resulting in a kernel paging fault at a virtual address. The same incorrect argument was also present in __regmap_init_slimbus() and was corrected as part of the fix (Red Hat Bugzilla).

Exploitation of this vulnerability causes a kernel panic ("Unable to handle kernel paging request") when audio playback is attempted on affected devices, resulting in a denial of service. The availability impact is high — the system or audio subsystem crashes — while there is no confidentiality or integrity impact. Affected systems include those running Linux kernels with the WCD934x ASoC codec driver on SlimBus-based platforms such as Qualcomm SDM845 devices (Red Hat Advisory, Red Hat Bugzilla).

There is no known public proof-of-concept exploit, and no evidence of in-the-wild exploitation has been reported. The vulnerability requires local access with low privileges (e.g., a user running aplay) to trigger the kernel crash. The EPSS score is 0.024% (very low probability of exploitation), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Red Hat Advisory).

• Logs: Kernel log entries containing Unable to handle kernel paging request at virtual address originating from the SlimBus or regmap subsystem during audio operations.
• Process: Crash or hang of processes invoking audio playback (e.g., aplay) on affected SlimBus-based devices.
• Kernel Call Trace: Stack traces referencing slim_xfer_msg, regmap_slimbus_read, _regmap_raw_read, wcd934x_hw_params, and snd_pcm_hw_params in kernel logs (Red Hat Bugzilla).

Apply the upstream Linux kernel patch that corrects the bus_context pointer in both __devm_regmap_init_slimbus() and __regmap_init_slimbus(). Fixes are available in stable kernel trees (commits 02d3041caaa3, 434f7349a1f0, 2664bfd8969d). Distribution-specific updates are available from Ubuntu (USN-8096-1, USN-8096-2, USN-8096-3, USN-8116-1) and Debian (DLA-4436-1). As a temporary workaround, avoid audio playback operations on affected SlimBus-based devices until the patch is applied (Red Hat Bugzilla, Ubuntu USN-8096-1).