CVE-2025-40070

CVE-2025-40070 addresses a warning and potential use-after-free issue within the Linux kernel's Pulse Per Second (PPS) subsystem. Specifically, it corrects an error handling flaw in the pps_register_cdev function, which could lead to a kernel warning during device registration failures and a double-free scenario in pps_register_source. This vulnerability affects the Linux kernel, though specific versions are not detailed beyond the 6.17.0-rc3+ example. The vulnerability's severity is low, with no assigned CVSS score and a FAUCET Risk Score of 5/100. It appears to be a local issue, likely requiring specific conditions during device registration to trigger the warning or double-free, suggesting a high attack complexity. The primary impact is system instability (kernel warning) or potential memory corruption (double-free), rather than direct remote code execution or data exfiltration. There is no evidence of active exploitation for CVE-2025-40070. No exploit code is publicly available on platforms like Metasploit or ExploitDB, and it is not listed in the CISA KEV catalog. Community discussion and media coverage are minimal, indicating a lack of widespread attention or perceived exploitability.