Skip to main content

Linux Kernel CVE-2025-40356

HIGH
2025-12-16 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
4.5 MEDIUM

Local hardware-bound driver bug requiring specific Rockchip SFC hardware and privileged flash operation, so AV:L, AC:H, PR:L; real disclosure/corruption impact is uncertain, rated Low.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 07:31 vuln.today
CVE Published
Dec 16, 2025 - 14:15 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

spi: rockchip-sfc: Fix DMA-API usage

Use DMA-API dma_map_single() call for getting the DMA address of the transfer buffer instead of hacking with virt_to_phys().

This fixes the following DMA-API debug warning: ------------[ cut here ]------------ DMA-API: rockchip-sfc fe300000.spi: device driver tries to sync DMA memory it has not allocated [device address=0x000000000cf70000] [size=288 bytes] WARNING: kernel/dma/debug.c:1106 at check_sync+0x1d8/0x690, CPU#2: systemd-udevd/151 Modules linked in: ... Hardware name: Hardkernel ODROID-M1 (DT) pstate: 604000c9 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : check_sync+0x1d8/0x690 lr : check_sync+0x1d8/0x690 .. Call trace: check_sync+0x1d8/0x690 (P) debug_dma_sync_single_for_cpu+0x84/0x8c __dma_sync_single_for_cpu+0x88/0x234 rockchip_sfc_exec_mem_op+0x4a0/0x798 [spi_rockchip_sfc] spi_mem_exec_op+0x408/0x498 spi_nor_read_data+0x170/0x184 spi_nor_read_sfdp+0x74/0xe4 spi_nor_parse_sfdp+0x120/0x11f0 spi_nor_sfdp_init_params_deprecated+0x3c/0x8c spi_nor_scan+0x690/0xf88 spi_nor_probe+0xe4/0x304 spi_mem_probe+0x6c/0xa8 spi_probe+0x94/0xd4 really_probe+0xbc/0x298 ...

AnalysisAI

Local privilege-relevant memory corruption/disclosure risk exists in the Linux kernel's Rockchip SFC (Serial Flash Controller) SPI driver (spi-rockchip-sfc), where improper DMA-API usage - deriving DMA addresses via virt_to_phys() instead of dma_map_single() - causes the driver to sync DMA memory it never properly mapped. On affected Rockchip-based systems (e.g. ODROID-M1), this triggers a DMA-API debug warning and reflects an underlying unsafe memory-transfer path during SPI-NOR flash operations. No public exploit identified at time of analysis; EPSS probability is low (0.16%, 6th percentile).

Technical ContextAI

The affected component is the Rockchip Serial Flash Controller SPI driver (spi-rockchip-sfc) in the Linux kernel, used to interface with SPI-NOR flash memory on Rockchip SoCs. The bug lies in rockchip_sfc_exec_mem_op(), which previously used virt_to_phys() to obtain a bus/DMA address for the transfer buffer and then called dma_sync_single_for_cpu() on it. Because the buffer was never registered through the streaming DMA-API (dma_map_single()), the kernel's DMA debug layer flags a sync on unmapped memory, and on systems with IOMMUs or non-trivial DMA topologies the physical address from virt_to_phys() is not a valid DMA handle. The fix replaces the virt_to_phys() hack with a proper dma_map_single()/dma_unmap_single() pairing. The root-cause class is improper DMA memory management (analogous to CWE-822/CWE-125-style out-of-bounds or untranslated memory access); the CWE field is marked N/A in the source data.

Affected ProductsAI

The Linux kernel, specifically the Rockchip Serial Flash Controller SPI driver (spi-rockchip-sfc / spi_rockchip_sfc module) on Rockchip SoC platforms such as the Hardkernel ODROID-M1. No CPE strings were provided in the source data, and no exact affected version range or fixed tagged release is specified. The fix is tracked in the stable kernel tree via two commits: https://git.kernel.org/stable/c/22810d4cb0e8a7d51b24527e73beac60afc1c693 and https://git.kernel.org/stable/c/ee795e82e10197c070efd380dc9615c73dffad6c. Affected versions must be inferred as kernels containing the spi-rockchip-sfc driver prior to these patches.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed. Apply the kernel stable-tree fixes referenced at https://git.kernel.org/stable/c/22810d4cb0e8a7d51b24527e73beac60afc1c693 and https://git.kernel.org/stable/c/ee795e82e10197c070efd380dc9615c73dffad6c, or update to a distribution kernel that has backported them. Because no exact fixed release tag is provided in the input, confirm the corresponding stable-kernel version with your distribution vendor before deployment. As a compensating control on affected Rockchip devices, unbind or blacklist the spi_rockchip_sfc module if the on-board SPI-NOR flash is not required - with the trade-off that any storage or boot dependency on that flash controller will be lost; there is no network-facing service to firewall since exploitation is local and hardware-bound.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

CVE-2025-40356 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy