CVE-2025-40030
Published Oct 28, 2025
Modified Apr 15, 2026
Description
In the Linux kernel, the following vulnerability has been resolved: pinctrl: check the return value of pinmux_ops::get_function_name() While the API contract in docs doesn't specify it explicitly, the generic implementation of the get_function_name() callback from struct pinmux_ops - pinmux_generic_get_function_name() - can fail and return NULL. This is already checked in pinmux_check_ops() so add a similar check in pinmux_func_name_to_selector() instead of passing the returned pointer right down to strcmp() where the NULL can get dereferenced. This is normal operation when adding new pinfunctions.
Is your site exposed to CVE-2025-40030?
Run a free security scan — no signup, results in seconds.
References
Other References
https://git.kernel.org/stable/c/1a2ea887a5cd7d47bab599f733d89444df018b1a
https://git.kernel.org/stable/c/1a7fc8fed2bb2e113604fde7a45432ace2056b97
https://git.kernel.org/stable/c/4002ee98c022d671ecc1e4a84029e9ae7d8a5603
https://git.kernel.org/stable/c/688c688e0bf55824f4a38f8c2180046f089a3e3b
https://git.kernel.org/stable/c/b7e0535060a60cc99eafc19cc665d979714cd73a
https://git.kernel.org/stable/c/ba7f7c2b2b3261e7def67018c38c69b626e0e66e
https://git.kernel.org/stable/c/d77ef2f621cd1d605372c4c6ce667c496f6990c3
https://git.kernel.org/stable/c/e7265dc4c670b89611bcf5fe33acf99bc0aa294f
Frequently Asked Questions
What is CVE-2025-40030? +
In the Linux kernel, the following vulnerability has been resolved:
pinctrl: check the return value of pinmux_ops::get_function_name()
While the API contract in docs doesn't specify it explicitly, the
generic implementation of the get_function_name() callback from struct
pinmux_ops - pinmux_generic_get_function_name() - can fail and return
NULL. This is already checked in pinmux_check_ops() so add a similar
check in pinmux_func_name_to_selector() instead of passing the returned
pointer right down to strcmp() where the NULL can get dereferenced. This
is normal operation when adding new pinfunctions.
How do I check if I'm vulnerable to CVE-2025-40030? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.