Memory Access Vulnerability in Linux Kernel: hwmon (asus-ec-sensors)
Summary
CVE-2025-38142: In the Linux kernel, the following vulnerability has been resolved: hwmon: (asus-ec-sensors) check sensor index in read_string() Prevent a potential invalid memory access when the requested sensor is not found. Affects linux versions < 6.1.147-1. Fixed in 6.1.147-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, responsible for managing hardware and system resources. It provides essential services for all other parts of the operating system. The hwmon subsystem is specifically designed for monitoring hardware parameters such as temperature and voltage. This vulnerability affects the asus-ec-sensors within the hwmon subsystem, which can lead to undefined behavior if sensor indices are not properly validated.
Vulnerability Detail
In the Linux kernel, a vulnerability was identified in the hwmon subsystem related to the asus-ec-sensors. The function find_ec_sensor_index() may return a negative value, such as -ENOENT, when a requested sensor is not found. This negative value was used without proper validation, potentially leading to invalid memory access and undefined behavior when passed to get_sensor_info(). The issue was discovered by the Linux Verification Center using SVACE, highlighting the importance of input validation in system-level programming.
How To Fix
Minimum fixed version
6.1.147-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. However, users are advised to monitor their systems for updates and apply patches as soon as they are available.
Conclusion
The CVE-2025-38142 vulnerability in the Linux kernel's hwmon subsystem poses a risk of invalid memory access due to improper sensor index validation. Users are encouraged to update their systems to the patched version of the Linux kernel to mitigate this risk. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38142 is a vulnerability in the Linux kernel's hwmon subsystem that can lead to invalid memory access due to improper validation of sensor indices.
You can use Vulert, which allows you to monitor and alert for open-source vulnerabilities in your software without requiring access to the code. Simply upload your manifest file like package-lock.json.
If exploited, this vulnerability could lead to undefined behavior in the system, potentially causing crashes or other erratic behavior.
Yes, a patch has been released for this vulnerability. Users should update their Linux kernel to the latest version to ensure they are protected.
You can use tools like Vulert to monitor your applications for vulnerabilities in real-time, ensuring you are alerted to any issues as they arise.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
