PT-2025-17284 · Linux+4 · Linux Kernel+4
Published
2025-03-25
·
Updated
2026-04-20
·
CVE-2025-40014
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.14.1
Description
The issue is related to an out-of-bounds stack access in the
amd set spi freq() function. When speed hz is less than AMD SPI MIN HZ, the function iterates over the entire amd spi freq array without stopping early, causing the index i to exceed the array bounds. This is fixed by stopping the loop at the last entry, effectively clamping low speed hz values up to AMD SPI MIN HZ. The fix resolves a warning that occurs with an UBSAN kernel, specifically in the drivers/spi/spi-amd.o file where amd set spi freq() falls through to the next function amd spi set opcode().Recommendations
For Linux kernel versions prior to 6.14.1, consider updating to a version that includes the fix for the out-of-bounds stack access in
amd set spi freq(). As a temporary workaround, consider restricting the use of the amd set spi freq() function to prevent potential exploitation.Exploit
Fix
Improper Validation of Array Index
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Debian
Linux Kernel
Suse
Ubuntu