{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-40356", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.187Z", "datePublished": "2025-12-16T13:30:28.913Z", "dateUpdated": "2026-08-05T12:09:52.400Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:09:52.400Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: rockchip-sfc: Fix DMA-API usage\n\nUse DMA-API dma_map_single() call for getting the DMA address of the\ntransfer buffer instead of hacking with virt_to_phys().\n\nThis fixes the following DMA-API debug warning:\n------------[ cut here ]------------\nDMA-API: rockchip-sfc fe300000.spi: device driver tries to sync DMA memory it has not allocated [device address=0x000000000cf70000] [size=288 bytes]\nWARNING: kernel/dma/debug.c:1106 at check_sync+0x1d8/0x690, CPU#2: systemd-udevd/151\nModules linked in: ...\nHardware name: Hardkernel ODROID-M1 (DT)\npstate: 604000c9 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : check_sync+0x1d8/0x690\nlr : check_sync+0x1d8/0x690\n..\nCall trace:\n check_sync+0x1d8/0x690 (P)\n debug_dma_sync_single_for_cpu+0x84/0x8c\n __dma_sync_single_for_cpu+0x88/0x234\n rockchip_sfc_exec_mem_op+0x4a0/0x798 [spi_rockchip_sfc]\n spi_mem_exec_op+0x408/0x498\n spi_nor_read_data+0x170/0x184\n spi_nor_read_sfdp+0x74/0xe4\n spi_nor_parse_sfdp+0x120/0x11f0\n spi_nor_sfdp_init_params_deprecated+0x3c/0x8c\n spi_nor_scan+0x690/0xf88\n spi_nor_probe+0xe4/0x304\n spi_mem_probe+0x6c/0xa8\n spi_probe+0x94/0xd4\n really_probe+0xbc/0x298\n ..." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable code is a platform SPI-flash controller driver reached through local flash I/O — `mtd` character-device access or ordinary file reads on a SPI-NOR-backed rootfs — via `spi_mem_exec_op` → `rockchip_sfc_exec_mem_op`. There is no network or remote-peer input anywhere on the path, and no physical access is needed since the DMA path is driven by normal local software operations.\nAC:L - The wrong DMA address is programmed unconditionally at probe and used on every DMA transfer — there is no race, no timing window, and no dependence on memory layout the attacker cannot influence. Any transfer with `len >= 0x40` and 4-byte-aligned length deterministically takes the flawed path.\nPR:L - No capability or permission check exists on the path from `mtd_read` down to `rockchip_sfc_exec_mem_op`, so on these embedded Rockchip boards any unprivileged local user reading a file from the flash-backed filesystem drives the defective DMA path. The probe-time occurrence needs no privileges at all, but a local unprivileged account is the appropriate attacker model.\nUI:N - No victim action is required — the bogus DMA address is installed during device probe at boot and is used by every subsequent flash transfer. Nothing must be mounted, opened, or clicked by another user.\nS:U - The mis-programmed DMA and the resulting corruption both land in kernel-owned memory under the same security authority. I verified that no upstream Rockchip device tree places the SFC behind an IOMMU/SMMU, so no hypervisor or IOMMU authority boundary is actually crossed on affected platforms.\nC:H - Skipping `dma_map_single()` omits the required cache maintenance, so `memcpy(op->data.buf.in, sfc->buffer, len)` can return residual contents of the previously-freed pages, and on any configuration with a DMA offset, SMMU, swiotlb bounce, or restricted DMA pool the driver reads back memory entirely outside the intended buffer. Either way unrelated kernel memory is disclosed to the reader of the flash device.\nI:H - The bus-mastering SFC engine is handed an address the DMA layer never validated or translated, so on non-identity-mapping configurations it performs out-of-bounds DMA writes into unrelated physical memory, and `dcache_inval_poc()` on the wrong range silently discards dirty cache lines belonging to other kernel allocations. The mapping is `DMA_BIDIRECTIONAL`, so both the device-write and cache-invalidate corruption primitives apply.\nA:H - The defect trips a kernel `WARNING` in `check_sync()` on the ordinary boot path, which is an immediate panic under the common `panic_on_warn` hardening setting, and the unsynchronized/misdirected DMA produces `-ETIMEDOUT` transfer failures, controller resets, and corruption of a flash-backed root filesystem." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/spi/spi-rockchip-sfc.c" ], "versions": [ { "version": "b69386fcbc6066fb4885667743ab4d4967d561b8", "lessThan": "22810d4cb0e8a7d51b24527e73beac60afc1c693", "status": "affected", "versionType": "git" }, { "version": "b69386fcbc6066fb4885667743ab4d4967d561b8", "lessThan": "ee795e82e10197c070efd380dc9615c73dffad6c", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/spi/spi-rockchip-sfc.c" ], "versions": [ { "version": "6.14", "status": "affected" }, { "version": "0", "lessThan": "6.14", "status": "unaffected", "versionType": "semver" }, { "version": "6.17.6", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "6.17.6" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "6.18" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/22810d4cb0e8a7d51b24527e73beac60afc1c693" }, { "url": "https://git.kernel.org/stable/c/ee795e82e10197c070efd380dc9615c73dffad6c" } ], "title": "spi: rockchip-sfc: Fix DMA-API usage", "x_generator": { "engine": "bippy-1.2.0" } } } }