CVE-2025-40356 (GCVE-0-2025-40356)

Vulnerability from cvelistv5 – Published: 2025-12-16 13:30 – Updated: 2026-08-05 12:09
VLAI
Title
spi: rockchip-sfc: Fix DMA-API usage
Summary
In the Linux kernel, the following vulnerability has been resolved: spi: rockchip-sfc: Fix DMA-API usage Use DMA-API dma_map_single() call for getting the DMA address of the transfer buffer instead of hacking with virt_to_phys(). This fixes the following DMA-API debug warning: ------------[ cut here ]------------ DMA-API: rockchip-sfc fe300000.spi: device driver tries to sync DMA memory it has not allocated [device address=0x000000000cf70000] [size=288 bytes] WARNING: kernel/dma/debug.c:1106 at check_sync+0x1d8/0x690, CPU#2: systemd-udevd/151 Modules linked in: ... Hardware name: Hardkernel ODROID-M1 (DT) pstate: 604000c9 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : check_sync+0x1d8/0x690 lr : check_sync+0x1d8/0x690 .. Call trace: check_sync+0x1d8/0x690 (P) debug_dma_sync_single_for_cpu+0x84/0x8c __dma_sync_single_for_cpu+0x88/0x234 rockchip_sfc_exec_mem_op+0x4a0/0x798 [spi_rockchip_sfc] spi_mem_exec_op+0x408/0x498 spi_nor_read_data+0x170/0x184 spi_nor_read_sfdp+0x74/0xe4 spi_nor_parse_sfdp+0x120/0x11f0 spi_nor_sfdp_init_params_deprecated+0x3c/0x8c spi_nor_scan+0x690/0xf88 spi_nor_probe+0xe4/0x304 spi_mem_probe+0x6c/0xa8 spi_probe+0x94/0xd4 really_probe+0xbc/0x298 ...
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: b69386fcbc6066fb4885667743ab4d4967d561b8 , < 22810d4cb0e8a7d51b24527e73beac60afc1c693 (git)
Affected: b69386fcbc6066fb4885667743ab4d4967d561b8 , < ee795e82e10197c070efd380dc9615c73dffad6c (git)
Create a notification for this product.
Linux Linux Affected: 6.14
Unaffected: 0 , < 6.14 (semver)
Unaffected: 6.17.6 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/spi/spi-rockchip-sfc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "22810d4cb0e8a7d51b24527e73beac60afc1c693",
              "status": "affected",
              "version": "b69386fcbc6066fb4885667743ab4d4967d561b8",
              "versionType": "git"
            },
            {
              "lessThan": "ee795e82e10197c070efd380dc9615c73dffad6c",
              "status": "affected",
              "version": "b69386fcbc6066fb4885667743ab4d4967d561b8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/spi/spi-rockchip-sfc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.6",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: rockchip-sfc: Fix DMA-API usage\n\nUse DMA-API dma_map_single() call for getting the DMA address of the\ntransfer buffer instead of hacking with virt_to_phys().\n\nThis fixes the following DMA-API debug warning:\n------------[ cut here ]------------\nDMA-API: rockchip-sfc fe300000.spi: device driver tries to sync DMA memory it has not allocated [device address=0x000000000cf70000] [size=288 bytes]\nWARNING: kernel/dma/debug.c:1106 at check_sync+0x1d8/0x690, CPU#2: systemd-udevd/151\nModules linked in: ...\nHardware name: Hardkernel ODROID-M1 (DT)\npstate: 604000c9 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : check_sync+0x1d8/0x690\nlr : check_sync+0x1d8/0x690\n..\nCall trace:\n check_sync+0x1d8/0x690 (P)\n debug_dma_sync_single_for_cpu+0x84/0x8c\n __dma_sync_single_for_cpu+0x88/0x234\n rockchip_sfc_exec_mem_op+0x4a0/0x798 [spi_rockchip_sfc]\n spi_mem_exec_op+0x408/0x498\n spi_nor_read_data+0x170/0x184\n spi_nor_read_sfdp+0x74/0xe4\n spi_nor_parse_sfdp+0x120/0x11f0\n spi_nor_sfdp_init_params_deprecated+0x3c/0x8c\n spi_nor_scan+0x690/0xf88\n spi_nor_probe+0xe4/0x304\n spi_mem_probe+0x6c/0xa8\n spi_probe+0x94/0xd4\n really_probe+0xbc/0x298\n ..."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is a platform SPI-flash controller driver reached through local flash I/O \u2014 `mtd` character-device access or ordinary file reads on a SPI-NOR-backed rootfs \u2014 via `spi_mem_exec_op` \u2192 `rockchip_sfc_exec_mem_op`. There is no network or remote-peer input anywhere on the path, and no physical access is needed since the DMA path is driven by normal local software operations.\nAC:L - The wrong DMA address is programmed unconditionally at probe and used on every DMA transfer \u2014 there is no race, no timing window, and no dependence on memory layout the attacker cannot influence. Any transfer with `len \u003e= 0x40` and 4-byte-aligned length deterministically takes the flawed path.\nPR:L - No capability or permission check exists on the path from `mtd_read` down to `rockchip_sfc_exec_mem_op`, so on these embedded Rockchip boards any unprivileged local user reading a file from the flash-backed filesystem drives the defective DMA path. The probe-time occurrence needs no privileges at all, but a local unprivileged account is the appropriate attacker model.\nUI:N - No victim action is required \u2014 the bogus DMA address is installed during device probe at boot and is used by every subsequent flash transfer. Nothing must be mounted, opened, or clicked by another user.\nS:U - The mis-programmed DMA and the resulting corruption both land in kernel-owned memory under the same security authority. I verified that no upstream Rockchip device tree places the SFC behind an IOMMU/SMMU, so no hypervisor or IOMMU authority boundary is actually crossed on affected platforms.\nC:H - Skipping `dma_map_single()` omits the required cache maintenance, so `memcpy(op-\u003edata.buf.in, sfc-\u003ebuffer, len)` can return residual contents of the previously-freed pages, and on any configuration with a DMA offset, SMMU, swiotlb bounce, or restricted DMA pool the driver reads back memory entirely outside the intended buffer. Either way unrelated kernel memory is disclosed to the reader of the flash device.\nI:H - The bus-mastering SFC engine is handed an address the DMA layer never validated or translated, so on non-identity-mapping configurations it performs out-of-bounds DMA writes into unrelated physical memory, and `dcache_inval_poc()` on the wrong range silently discards dirty cache lines belonging to other kernel allocations. The mapping is `DMA_BIDIRECTIONAL`, so both the device-write and cache-invalidate corruption primitives apply.\nA:H - The defect trips a kernel `WARNING` in `check_sync()` on the ordinary boot path, which is an immediate panic under the common `panic_on_warn` hardening setting, and the unsynchronized/misdirected DMA produces `-ETIMEDOUT` transfer failures, controller resets, and corruption of a flash-backed root filesystem."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:09:52.400Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/22810d4cb0e8a7d51b24527e73beac60afc1c693"
        },
        {
          "url": "https://git.kernel.org/stable/c/ee795e82e10197c070efd380dc9615c73dffad6c"
        }
      ],
      "title": "spi: rockchip-sfc: Fix DMA-API usage",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40356",
    "datePublished": "2025-12-16T13:30:28.913Z",
    "dateReserved": "2025-04-16T07:20:57.187Z",
    "dateUpdated": "2026-08-05T12:09:52.400Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-40356",
      "date": "2026-08-14",
      "epss": "0.0014",
      "percentile": "0.03824"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-40356\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-16T14:15:47.530\",\"lastModified\":\"2026-07-30T06:24:31.117\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nspi: rockchip-sfc: Fix DMA-API usage\\n\\nUse DMA-API dma_map_single() call for getting the DMA address of the\\ntransfer buffer instead of hacking with virt_to_phys().\\n\\nThis fixes the following DMA-API debug warning:\\n------------[ cut here ]------------\\nDMA-API: rockchip-sfc fe300000.spi: device driver tries to sync DMA memory it has not allocated [device address=0x000000000cf70000] [size=288 bytes]\\nWARNING: kernel/dma/debug.c:1106 at check_sync+0x1d8/0x690, CPU#2: systemd-udevd/151\\nModules linked in: ...\\nHardware name: Hardkernel ODROID-M1 (DT)\\npstate: 604000c9 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\\npc : check_sync+0x1d8/0x690\\nlr : check_sync+0x1d8/0x690\\n..\\nCall trace:\\n check_sync+0x1d8/0x690 (P)\\n debug_dma_sync_single_for_cpu+0x84/0x8c\\n __dma_sync_single_for_cpu+0x88/0x234\\n rockchip_sfc_exec_mem_op+0x4a0/0x798 [spi_rockchip_sfc]\\n spi_mem_exec_op+0x408/0x498\\n spi_nor_read_data+0x170/0x184\\n spi_nor_read_sfdp+0x74/0xe4\\n spi_nor_parse_sfdp+0x120/0x11f0\\n spi_nor_sfdp_init_params_deprecated+0x3c/0x8c\\n spi_nor_scan+0x690/0xf88\\n spi_nor_probe+0xe4/0x304\\n spi_mem_probe+0x6c/0xa8\\n spi_probe+0x94/0xd4\\n really_probe+0xbc/0x298\\n ...\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/spi/spi-rockchip-sfc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"b69386fcbc6066fb4885667743ab4d4967d561b8\",\"lessThan\":\"22810d4cb0e8a7d51b24527e73beac60afc1c693\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b69386fcbc6066fb4885667743ab4d4967d561b8\",\"lessThan\":\"ee795e82e10197c070efd380dc9615c73dffad6c\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/spi/spi-rockchip-sfc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17.6\",\"lessThanOrEqual\":\"6.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/22810d4cb0e8a7d51b24527e73beac60afc1c693\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ee795e82e10197c070efd380dc9615c73dffad6c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-13T17:39:12+00:00",
      "cve": "CVE-2025-40356",
      "id": "CVE-2025-40356",
      "initial_release_date": "2025-12-16T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: `spi: rockchip-sfc` improper DMA usage leading to privilege escalation",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40356.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-31T01:01:30Z",
      "cve": "CVE-2025-40356",
      "id": "CVE-2025-40356",
      "initial_release_date": "2025-12-17T00:30:25Z",
      "product_status:known_not_affected": "418",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-40356",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-40356.json",
      "version": "8"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.