CVE-2025-22067

spi: cadence: Fix out-of-bounds array access in cdns_mrvl_xspi_setup_clock()

High · published April 16, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
10.9
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

spi: cadence: Fix out-of-bounds array access in cdns_mrvl_xspi_setup_clock()

If requested_clk > 128, cdns_mrvl_xspi_setup_clock() iterates over the

entire cdns_mrvl_xspi_clk_div_list array without breaking out early,

causing 'i' to go beyond the array bounds.

Fix that by stopping the loop when it gets to the last entry, clamping

the clock to the minimum 6.25 MHz.

Fixes the following warning with an UBSAN kernel:

vmlinux.o: warning: objtool: cdns_mrvl_xspi_setup_clock: unexpected end of section .text.cdns_mrvl_xspi_setup_clock

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00212 · 10.9th percentile
Published
2025-04-16T14:12Z
EPSS history
Timeline
  • 16 APR 14:12Z
    spi: cadence: Fix out-of-bounds array access in cdns_mrvl_xspi_setup_clock()
    cvelistv5