CVE-2025-40014

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.14.1

Description The issue is related to an out-of-bounds stack access in the amd set spi freq() function. When speed hz is less than AMD SPI MIN HZ, the function iterates over the entire amd spi freq array without stopping early, causing the index i to exceed the array bounds. This is fixed by stopping the loop at the last entry, effectively clamping low speed hz values up to AMD SPI MIN HZ. The fix resolves a warning that occurs with an UBSAN kernel, specifically in the drivers/spi/spi-amd.o file where amd set spi freq() falls through to the next function amd spi set opcode().

Recommendations For Linux kernel versions prior to 6.14.1, consider updating to a version that includes the fix for the out-of-bounds stack access in amd set spi freq(). As a temporary workaround, consider restricting the use of the amd set spi freq() function to prevent potential exploitation.