{
  "cveId": "CVE-2025-40208",
  "url": "https://patchblox.com/security/cve/CVE-2025-40208",
  "summary": "CVE-2025-40208 is fixed in linux on 1 platform by DEBIAN-CVE-2025-40208 (version 6.17.6-1), released November 12, 2025. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  media: iris: fix module removal if firmware down...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  media: iris: fix module removal if firmware download failed  Fix remove if firmware failed to load: qcom-iris aa00000.video-codec: Direct firmware load for qcom/vpu/vpu33_p4.mbn failed with error -2 qcom-iris aa00000.video-codec: firmware download failed qcom-iris aa00000.video-codec: core init failed  then: $ echo aa00000.video-codec \u003E /sys/bus/platform/drivers/qcom-iris/unbind  Triggers: genpd genpd:1:aa00000.video-codec: Runtime PM usage count underflow! ------------[ cut here ]------------ video_cc_mvs0_clk already disabled WARNING: drivers/clk/clk.c:1206 at clk_core_disable\u002B0xa4/0xac, CPU#1: sh/542 \u003Csnip\u003E pc : clk_core_disable\u002B0xa4/0xac lr : clk_core_disable\u002B0xa4/0xac \u003Csnip\u003E Call trace:  clk_core_disable\u002B0xa4/0xac (P)  clk_disable\u002B0x30/0x4c  iris_disable_unprepare_clock\u002B0x20/0x48 [qcom_iris]  iris_vpu_power_off_hw\u002B0x48/0x58 [qcom_iris]  iris_vpu33_power_off_hardware\u002B0x44/0x230 [qcom_iris]  iris_vpu_power_off\u002B0x34/0x84 [qcom_iris]  iris_core_deinit\u002B0x44/0xc8 [qcom_iris]  iris_remove\u002B0x20/0x48 [qcom_iris]  platform_remove\u002B0x20/0x30  device_remove\u002B0x4c/0x80 \u003Csnip\u003E ---[ end trace 0000000000000000 ]--- ------------[ cut here ]------------ video_cc_mvs0_clk already unprepared WARNING: drivers/clk/clk.c:1065 at clk_core_unprepare\u002B0xf0/0x110, CPU#2: sh/542 \u003Csnip\u003E pc : clk_core_unprepare\u002B0xf0/0x110 lr : clk_core_unprepare\u002B0xf0/0x110 \u003Csnip\u003E Call trace:  clk_core_unprepare\u002B0xf0/0x110 (P)  clk_unprepare\u002B0x2c/0x44  iris_disable_unprepare_clock\u002B0x28/0x48 [qcom_iris]  iris_vpu_power_off_hw\u002B0x48/0x58 [qcom_iris]  iris_vpu33_power_off_hardware\u002B0x44/0x230 [qcom_iris]  iris_vpu_power_off\u002B0x34/0x84 [qcom_iris]  iris_core_deinit\u002B0x44/0xc8 [qcom_iris]  iris_remove\u002B0x20/0x48 [qcom_iris]  platform_remove\u002B0x20/0x30  device_remove\u002B0x4c/0x80 \u003Csnip\u003E ---[ end trace 0000000000000000 ]--- genpd genpd:0:aa00000.video-codec: Runtime PM usage count underflow! ------------[ cut here ]------------ gcc_video_axi0_clk already disabled WARNING: drivers/clk/clk.c:1206 at clk_core_disable\u002B0xa4/0xac, CPU#4: sh/542 \u003Csnip\u003E pc : clk_core_disable\u002B0xa4/0xac lr : clk_core_disable\u002B0xa4/0xac \u003Csnip\u003E Call trace:  clk_core_disable\u002B0xa4/0xac (P)  clk_disable\u002B0x30/0x4c  iris_disable_unprepare_clock\u002B0x20/0x48 [qcom_iris]  iris_vpu33_power_off_controller\u002B0x17c/0x428 [qcom_iris]  iris_vpu_power_off\u002B0x48/0x84 [qcom_iris]  iris_core_deinit\u002B0x44/0xc8 [qcom_iris]  iris_remove\u002B0x20/0x48 [qcom_iris]  platform_remove\u002B0x20/0x30  device_remove\u002B0x4c/0x80 \u003Csnip\u003E ------------[ cut here ]------------ gcc_video_axi0_clk already unprepared WARNING: drivers/clk/clk.c:1065 at clk_core_unprepare\u002B0xf0/0x110, CPU#4: sh/542 \u003Csnip\u003E pc : clk_core_unprepare\u002B0xf0/0x110 lr : clk_core_unprepare\u002B0xf0/0x110 \u003Csnip\u003E Call trace:  clk_core_unprepare\u002B0xf0/0x110 (P)  clk_unprepare\u002B0x2c/0x44  iris_disable_unprepare_clock\u002B0x28/0x48 [qcom_iris]  iris_vpu33_power_off_controller\u002B0x17c/0x428 [qcom_iris]  iris_vpu_power_off\u002B0x48/0x84 [qcom_iris]  iris_core_deinit\u002B0x44/0xc8 [qcom_iris]  iris_remove\u002B0x20/0x48 [qcom_iris]  platform_remove\u002B0x20/0x30  device_remove\u002B0x4c/0x80 \u003Csnip\u003E ---[ end trace 0000000000000000 ]---  Skip deinit if initialization never succeeded.",
  "published": "2025-11-12T22:15:48Z",
  "severity": "",
  "epss": 0.00184,
  "epssPercentile": 0.08081,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.17.6-1",
      "fix": "DEBIAN-CVE-2025-40208",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-40208",
      "released": "2025-11-12T22:15:48Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}