CVE-2025-40014

Summary

CVE-2025-40amd_set_spi_freq() in the Linux kernel contains a vulnerability that allows for out-of-bounds stack access. This issue arises when the function iterates through the amd_spi_freq array without checking array bounds, leading 'i' to exceed the array limits. Consequently, the function falls through to the next function, amd_spi_set_opcode(), potentially causing a stack overflow. The vulnerability has been resolved by halting the loop at the last entry, thereby clamping down the speed_hz value to AMD_SPI_MIN_HZ. This patch addresses a UBSAN (Uninitialized Buffer Safety Analyzer) warning in the drivers/spi/spi-amd.o file.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.