Out of Bounds Access in Linux Kernel: spi-rockchip Vulnerability
Summary
CVE-2025-38081: In the Linux kernel, the following vulnerability has been resolved: spi-rockchip: Fix register out of bounds access Do not write native chip select stuff for GPIO chip selects. Affects linux versions 6.1.106-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interaction. It is known for its robustness, flexibility, and support for a wide range of hardware. The spi-rockchip driver is responsible for managing SPI (Serial Peripheral Interface) communications for Rockchip devices. This vulnerability affects the way GPIO chip selects are handled, potentially leading to unintended behavior.
Vulnerability Detail
The vulnerability identified as CVE-2025-38081 involves an out-of-bounds access issue in the spi-rockchip driver of the Linux kernel. This occurs when the driver attempts to write native chip select configurations for GPIO chip selects, which can be numbered significantly higher than the native chip select values. This mismanagement can lead to memory corruption or unexpected behavior in the system, posing risks to system stability and security.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, avoiding the use of GPIO chip selects that exceed native CS values may mitigate some risks until the package is updated.
Conclusion
CVE-2025-38081 presents a significant vulnerability in the Linux kernel's spi-rockchip driver, necessitating prompt attention. Users are advised to update their systems to the patched version to mitigate risks associated with this vulnerability. Regular monitoring and updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38081 is a vulnerability in the Linux kernel's spi-rockchip driver that allows for out-of-bounds access due to improper handling of GPIO chip selects.
This vulnerability can lead to memory corruption or unexpected behavior, potentially compromising system stability and security.
Versions of Linux in Debian 11, 12, and 13 are affected. It is crucial to check your specific version and update accordingly.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider avoiding the use of GPIO chip selects that exceed native CS values as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
