PT-2025-40095 · Linux+2 · Linux Kernel+2

Published 2025-10-01 · Updated 2025-10-01 · CVE-2025-39921

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw exists in the Linux kernel’s spi subsystem, specifically within the microchip-core-qspi driver. A logic error introduced during a modification to the supports op callback function causes an invalid check of op->max freq during probe operations. This results in a division by zero when calculating baud rate val, leading to the failure of probe operations for attached memory devices. The issue stems from copying logic into mchp coreqspi supports op() that relies on a zero value for op->max freq during the probe phase.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2025-39921

Affected Products

Astra Linux

Linux Kernel

Microchip-Core-Qspi Driver

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/39xxx/CVE-2025-39921.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-39921 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-39921 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-39921 · Security Note
• https://ubuntu.com/security/CVE-2025-39921 · Vendor Advisory
• https://git.kernel.org/stable/c/ac8a13f35d5b8996582b3f97b924838a5c570c18 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-39921 · Security Note
• https://git.kernel.org/stable/c/89e7353f522f5cf70cb48c01ce2dcdcb275b8022 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-39921 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-39921 · Vendor Advisory
• https://git.kernel.org/linus/89e7353f522f5cf70cb48c01ce2dcdcb275b8022 · Note
• https://t.me/CVEtracker/33798 · Telegram Post
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note
• https://twitter.com/CVEnew/status/1973302156124897704 · Twitter Post