Vulnerability in Cadence Quad SPI Driver for Linux Kernel

CVE-2025-40005

What is CVE-2025-40005?

The Cadence Quad SPI driver in the Linux kernel is affected by a vulnerability related to the improper handling of device unbinding during ongoing operations. This scenario can lead to kernel crashes, particularly when a root superuser performs a forced removal of the driver while it is still busy processing indirect read and write operations. To mitigate this issue, a fix has been implemented that introduces reference counting, allowing the driver to gracefully manage device disconnection by ensuring all operations are completed before proceeding with the removal.

References