{"id":"DEBIAN-CVE-2025-40208","details":"In the Linux kernel, the following vulnerability has been resolved:  media: iris: fix module removal if firmware download failed  Fix remove if firmware failed to load: qcom-iris aa00000.video-codec: Direct firmware load for qcom/vpu/vpu33_p4.mbn failed with error -2 qcom-iris aa00000.video-codec: firmware download failed qcom-iris aa00000.video-codec: core init failed  then: $ echo aa00000.video-codec \u003e /sys/bus/platform/drivers/qcom-iris/unbind  Triggers: genpd genpd:1:aa00000.video-codec: Runtime PM usage count underflow! ------------[ cut here ]------------ video_cc_mvs0_clk already disabled WARNING: drivers/clk/clk.c:1206 at clk_core_disable+0xa4/0xac, CPU#1: sh/542 \u003csnip\u003e pc : clk_core_disable+0xa4/0xac lr : clk_core_disable+0xa4/0xac \u003csnip\u003e Call trace:  clk_core_disable+0xa4/0xac (P)  clk_disable+0x30/0x4c  iris_disable_unprepare_clock+0x20/0x48 [qcom_iris]  iris_vpu_power_off_hw+0x48/0x58 [qcom_iris]  iris_vpu33_power_off_hardware+0x44/0x230 [qcom_iris]  iris_vpu_power_off+0x34/0x84 [qcom_iris]  iris_core_deinit+0x44/0xc8 [qcom_iris]  iris_remove+0x20/0x48 [qcom_iris]  platform_remove+0x20/0x30  device_remove+0x4c/0x80 \u003csnip\u003e ---[ end trace 0000000000000000 ]--- ------------[ cut here ]------------ video_cc_mvs0_clk already unprepared WARNING: drivers/clk/clk.c:1065 at clk_core_unprepare+0xf0/0x110, CPU#2: sh/542 \u003csnip\u003e pc : clk_core_unprepare+0xf0/0x110 lr : clk_core_unprepare+0xf0/0x110 \u003csnip\u003e Call trace:  clk_core_unprepare+0xf0/0x110 (P)  clk_unprepare+0x2c/0x44  iris_disable_unprepare_clock+0x28/0x48 [qcom_iris]  iris_vpu_power_off_hw+0x48/0x58 [qcom_iris]  iris_vpu33_power_off_hardware+0x44/0x230 [qcom_iris]  iris_vpu_power_off+0x34/0x84 [qcom_iris]  iris_core_deinit+0x44/0xc8 [qcom_iris]  iris_remove+0x20/0x48 [qcom_iris]  platform_remove+0x20/0x30  device_remove+0x4c/0x80 \u003csnip\u003e ---[ end trace 0000000000000000 ]--- genpd genpd:0:aa00000.video-codec: Runtime PM usage count underflow! ------------[ cut here ]------------ gcc_video_axi0_clk already disabled WARNING: drivers/clk/clk.c:1206 at clk_core_disable+0xa4/0xac, CPU#4: sh/542 \u003csnip\u003e pc : clk_core_disable+0xa4/0xac lr : clk_core_disable+0xa4/0xac \u003csnip\u003e Call trace:  clk_core_disable+0xa4/0xac (P)  clk_disable+0x30/0x4c  iris_disable_unprepare_clock+0x20/0x48 [qcom_iris]  iris_vpu33_power_off_controller+0x17c/0x428 [qcom_iris]  iris_vpu_power_off+0x48/0x84 [qcom_iris]  iris_core_deinit+0x44/0xc8 [qcom_iris]  iris_remove+0x20/0x48 [qcom_iris]  platform_remove+0x20/0x30  device_remove+0x4c/0x80 \u003csnip\u003e ------------[ cut here ]------------ gcc_video_axi0_clk already unprepared WARNING: drivers/clk/clk.c:1065 at clk_core_unprepare+0xf0/0x110, CPU#4: sh/542 \u003csnip\u003e pc : clk_core_unprepare+0xf0/0x110 lr : clk_core_unprepare+0xf0/0x110 \u003csnip\u003e Call trace:  clk_core_unprepare+0xf0/0x110 (P)  clk_unprepare+0x2c/0x44  iris_disable_unprepare_clock+0x28/0x48 [qcom_iris]  iris_vpu33_power_off_controller+0x17c/0x428 [qcom_iris]  iris_vpu_power_off+0x48/0x84 [qcom_iris]  iris_core_deinit+0x44/0xc8 [qcom_iris]  iris_remove+0x20/0x48 [qcom_iris]  platform_remove+0x20/0x30  device_remove+0x4c/0x80 \u003csnip\u003e ---[ end trace 0000000000000000 ]---  Skip deinit if initialization never succeeded.","modified":"2026-08-27T22:48:57.234309754Z","published":"2025-11-12T22:15:48.127Z","upstream":["CVE-2025-40208"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2025-40208"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.6-1"}]}],"versions":["6.12.100-1","6.12.101-1","6.12.105-1","6.12.38-1","6.12.41-1","6.12.43-1","6.12.43-1~bpo12+1","6.12.48-1","6.12.57-1","6.12.57-1~bpo12+1","6.12.63-1","6.12.63-1~bpo12+1","6.12.69-1","6.12.69-1~bpo12+1","6.12.73-1","6.12.73-1~bpo12+1","6.12.74-1","6.12.74-2","6.12.74-2~bpo12+1","6.12.85-1","6.12.85-1~bpo12+1","6.12.86-1","6.12.86-1~bpo12+1","6.12.88-1","6.12.88-1~bpo12+1","6.12.90-1","6.12.90-1~bpo12+1","6.12.90-2","6.12.90-2~bpo12+1","6.12.94-1","6.12.94-1~bpo12+1","6.12.95-1","6.12.95-1~bpo12+1","6.12.96-1","6.13.10-1~exp1","6.13.11-1~exp1","6.13.2-1~exp1","6.13.3-1~exp1","6.13.4-1~exp1","6.13.5-1~exp1","6.13.6-1~exp1","6.13.7-1~exp1","6.13.8-1~exp1","6.13.9-1~exp1","6.13~rc6-1~exp1","6.13~rc7-1~exp1","6.14.3-1~exp1","6.14.5-1~exp1","6.14.6-1~exp1","6.15-1~exp1","6.15.1-1~exp1","6.15.2-1~exp1","6.15.3-1~exp1","6.15.4-1~exp1","6.15.5-1~exp1","6.15.6-1~exp1","6.15~rc7-1~exp1","6.16-1~exp1","6.16.1-1~exp1","6.16.10-1","6.16.11-1","6.16.12-1","6.16.12-1~bpo13+1","6.16.12-2","6.16.3-1","6.16.3-1~bpo13+1","6.16.5-1","6.16.6-1","6.16.7-1","6.16.8-1","6.16.9-1","6.16~rc7-1~exp1","6.17.2-1~exp1","6.17.5-1~exp1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-40208.json"}}],"schema_version":"1.9.0"}