Out-of-Bounds Stack Access Vulnerability in Linux Kernel's SPI Driver by AMD

CVE-2025-40014

Summary

An out-of-bounds stack access vulnerability exists in the AMD SPI driver within the Linux kernel. The flaw arises from the amd_set_spi_freq() function, which, when provided with a speed_hz value lower than the required AMD_SPI_MIN_HZ, improperly iterates beyond the bounds of the amd_spi_freq array. This could result in unsafe memory access and lead to potential system instability or exploitation. The vulnerability has been addressed by correcting the loop condition to prevent exceeding the array bounds, ensuring safe operation of the SPI driver and the overall integrity of the Linux kernel.

References