Invalid Memory Access in Linux Kernel's Asus EC Sensors

CVE-2025-38142

What is CVE-2025-38142?

A vulnerability in the Linux kernel's handling of ASUS EC sensors can lead to invalid memory access when the requested sensor is not found. The function 'find_ec_sensor_index()' may return a negative value if a sensor is absent, which could subsequently cause undefined behavior when this value is passed to 'get_sensor_info()'. To mitigate this issue, a check has been added to ensure that if the sensor index is negative, an error code of -EINVAL is returned instead, enhancing system stability and security.

References