What’s Vulnerable › Vulnerabilities

CVE-2025-38081: spi-rockchip: Fix register out of bounds access

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-06-18 · updated 2026-10-30
• Weakness: CWE-125

Description

In the Linux kernel, the following vulnerability has been resolved: spi-rockchip: Fix register out of bounds access Do not write native chip select stuff for GPIO chip selects. GPIOs can be numbered much higher than native CS. Also, it makes no sense.

Affected products

• Linux kernel: from 5.14 before 6.6.93; from 6.7 before 6.12.31; from 6.13 before 6.14.9 — fixed in 6.6.93, 6.12.31, 6.14.9
• Linux: 5.14 — fixed in 6.15

How to fix

Upgrade to a fixed version: Linux kernel 6.6.93, 6.12.31, 6.14.9; Linux 6.15. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/254e04ec799c1ff8c1e2bd08a57c6a849895d6ff
• https://git.kernel.org/stable/c/4a120221661fcecb253448d7b041a52d47f1d91f
• https://git.kernel.org/stable/c/7a27d8dd9354f00e823dfb557b690ea44b4a146f
• https://git.kernel.org/stable/c/7a874e8b54ea21094f7fd2d428b164394c6cb316
• https://git.kernel.org/stable/c/ace57bd1fb49d193edec5f6a1f255f48dd5fca90

Get alerted when CVE-2025-38081 or the next vulnerability affects your stack