CVE-2025-38081 (GCVE-0-2025-38081)
Vulnerability from cvelistv5
Published
2025-06-18 09:33
Modified
2025-07-15 15:43
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: spi-rockchip: Fix register out of bounds access Do not write native chip select stuff for GPIO chip selects. GPIOs can be numbered much higher than native CS. Also, it makes no sense.
References
Impacted products
Vendor Product Version
Linux Linux Version: 736b81e075172f1e6cd7a8bc1a1374a2dee9e4dc
Version: 736b81e075172f1e6cd7a8bc1a1374a2dee9e4dc
Version: 736b81e075172f1e6cd7a8bc1a1374a2dee9e4dc
Version: 736b81e075172f1e6cd7a8bc1a1374a2dee9e4dc
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/spi/spi-rockchip.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4a120221661fcecb253448d7b041a52d47f1d91f",
              "status": "affected",
              "version": "736b81e075172f1e6cd7a8bc1a1374a2dee9e4dc",
              "versionType": "git"
            },
            {
              "lessThan": "ace57bd1fb49d193edec5f6a1f255f48dd5fca90",
              "status": "affected",
              "version": "736b81e075172f1e6cd7a8bc1a1374a2dee9e4dc",
              "versionType": "git"
            },
            {
              "lessThan": "254e04ec799c1ff8c1e2bd08a57c6a849895d6ff",
              "status": "affected",
              "version": "736b81e075172f1e6cd7a8bc1a1374a2dee9e4dc",
              "versionType": "git"
            },
            {
              "lessThan": "7a874e8b54ea21094f7fd2d428b164394c6cb316",
              "status": "affected",
              "version": "736b81e075172f1e6cd7a8bc1a1374a2dee9e4dc",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/spi/spi-rockchip.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.31",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.93",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.31",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.9",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi-rockchip: Fix register out of bounds access\n\nDo not write native chip select stuff for GPIO chip selects.\nGPIOs can be numbered much higher than native CS.\nAlso, it makes no sense."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-15T15:43:57.474Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4a120221661fcecb253448d7b041a52d47f1d91f"
        },
        {
          "url": "https://git.kernel.org/stable/c/ace57bd1fb49d193edec5f6a1f255f48dd5fca90"
        },
        {
          "url": "https://git.kernel.org/stable/c/254e04ec799c1ff8c1e2bd08a57c6a849895d6ff"
        },
        {
          "url": "https://git.kernel.org/stable/c/7a874e8b54ea21094f7fd2d428b164394c6cb316"
        }
      ],
      "title": "spi-rockchip: Fix register out of bounds access",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38081",
    "datePublished": "2025-06-18T09:33:54.564Z",
    "dateReserved": "2025-04-16T04:51:23.981Z",
    "dateUpdated": "2025-07-15T15:43:57.474Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38081\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-06-18T10:15:41.767\",\"lastModified\":\"2025-06-18T13:46:52.973\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nspi-rockchip: Fix register out of bounds access\\n\\nDo not write native chip select stuff for GPIO chip selects.\\nGPIOs can be numbered much higher than native CS.\\nAlso, it makes no sense.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: spi-rockchip: Se corrige el acceso fuera de los l\u00edmites al registro. No se debe escribir informaci\u00f3n de selecci\u00f3n de chip nativa para las selecciones de chip GPIO. Las GPIO pueden tener una numeraci\u00f3n mucho mayor que la de las CS nativas. Adem\u00e1s, no tiene sentido.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/254e04ec799c1ff8c1e2bd08a57c6a849895d6ff\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4a120221661fcecb253448d7b041a52d47f1d91f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7a874e8b54ea21094f7fd2d428b164394c6cb316\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ace57bd1fb49d193edec5f6a1f255f48dd5fca90\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.