CVE-2025-40014
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-40014
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-40014.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2025-40014
- Downstream
- Related
- Published
- 2025-04-18T07:15:44Z
- Modified
- 2025-08-30T18:01:36Z
- Severity
-
- 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
objtool, spi: amd: Fix out-of-bounds stack access in amdsetspi_freq()
If speedhz < AMDSPIMINHZ, amdsetspifreq() iterates over the entire amdspi_freq array without breaking out early, causing 'i' to go beyond the array bounds.
Fix that by stopping the loop when it gets to the last entry, so the low speedhz value gets clamped up to AMDSPIMINHZ.
Fixes the following warning with an UBSAN kernel:
drivers/spi/spi-amd.o: error: objtool: amdsetspifreq() falls through to next function amdspisetopcode()
- References