The Linux kernel vulnerability CVE-2025-40132 involves the ASoC Intel sof_sdw driver where the function create_sdw_dailink() did not verify that the add_sidecar callback pointer was non-NULL before invoking it. The code incorrectly assumed that if include_sidecar was true, the codec on the link would have a valid add_sidecar callback. However, other codecs on the same link might lack this callback, leading to a potential jump to a NULL pointer. This issue has been resolved by adding a check to ensure sof_end->codec_info->add_sidecar is not NULL before calling it. The vulnerability affects numerous Linux kernel versions, primarily in the linux-hwe-edge package, and has been patched in kernel versions 6.17.0-14.14 and later. The Ubuntu security advisories USN-8029-1 and USN-8030-1 confirm the fix and recommend updating to the specified patched kernel versions.

If exploited, this vulnerability could cause a kernel NULL pointer dereference, potentially leading to system crashes or denial of service. The vulnerability does not have confirmed exploits in the wild. The medium severity rating reflects the potential for system instability but does not indicate direct remote code execution or privilege escalation.

A patch is available for this vulnerability. Users should update their Linux kernel to version 6.17.0-14.14 or later (or the corresponding patched versions listed in the Ubuntu advisories USN-8029-1 and USN-8030-1) and reboot the system to apply the fix. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be required. Follow the vendor's update instructions carefully to ensure full remediation.