Linux Kernel Vulnerability in Microchip Core QSPI Driver

CVE-2025-39921

What is CVE-2025-39921?

A vulnerability in the Microchip Core QSPI driver of the Linux kernel arises from a flaw in the max_freq viability check during the probe process. When the function mchp_coreqspi_supports_op() calls the supports_op callback, it mismanages the op->max_freq parameter, leading it to default to zero. Consequently, this causes the baud_rate_val to miscalculate to INT_MAX due to division by zero. This issue specifically affects the probe functionality for connected memory devices, preventing them from being utilized correctly. The resolution involves reverting the recent changes to restore the driver’s original operation capability.

References