CVE-2025-22067

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-22067", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-29T08:45:45.813Z", "datePublished": "2025-04-16T14:12:20.795Z", "dateUpdated": "2026-05-11T21:12:00.224Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T21:12:00.224Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: cadence: Fix out-of-bounds array access in cdns_mrvl_xspi_setup_clock()\n\nIf requested_clk > 128, cdns_mrvl_xspi_setup_clock() iterates over the\nentire cdns_mrvl_xspi_clk_div_list array without breaking out early,\ncausing 'i' to go beyond the array bounds.\n\nFix that by stopping the loop when it gets to the last entry, clamping\nthe clock to the minimum 6.25 MHz.\n\nFixes the following warning with an UBSAN kernel:\n\n vmlinux.o: warning: objtool: cdns_mrvl_xspi_setup_clock: unexpected end of section .text.cdns_mrvl_xspi_setup_clock"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/spi/spi-cadence-xspi.c"], "versions": [{"version": "26d34fdc49712ddbd42b11102f5d9d78a0f42097", "lessThan": "e50781bf7accc75883cb8a6a9921fb4e2fa8cca4", "status": "affected", "versionType": "git"}, {"version": "26d34fdc49712ddbd42b11102f5d9d78a0f42097", "lessThan": "c1fb84e274cb6a2bce6ba5e65116c06e0b3ab275", "status": "affected", "versionType": "git"}, {"version": "26d34fdc49712ddbd42b11102f5d9d78a0f42097", "lessThan": "645f1813fe0dc96381c36b834131e643b798fd73", "status": "affected", "versionType": "git"}, {"version": "26d34fdc49712ddbd42b11102f5d9d78a0f42097", "lessThan": "7ba0847fa1c22e7801cebfe5f7b75aee4fae317e", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/spi/spi-cadence-xspi.c"], "versions": [{"version": "6.12", "status": "affected"}, {"version": "0", "lessThan": "6.12", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.23", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.13.11", "lessThanOrEqual": "6.13.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.14.2", "lessThanOrEqual": "6.14.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.12.23"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.13.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.14.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.15"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e50781bf7accc75883cb8a6a9921fb4e2fa8cca4"}, {"url": "https://git.kernel.org/stable/c/c1fb84e274cb6a2bce6ba5e65116c06e0b3ab275"}, {"url": "https://git.kernel.org/stable/c/645f1813fe0dc96381c36b834131e643b798fd73"}, {"url": "https://git.kernel.org/stable/c/7ba0847fa1c22e7801cebfe5f7b75aee4fae317e"}], "title": "spi: cadence: Fix out-of-bounds array access in cdns_mrvl_xspi_setup_clock()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-129", "lang": "en", "description": "CWE-129 Improper Validation of Array Index"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-10-01T16:32:18.714554Z", "id": "CVE-2025-22067", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T20:16:45.979Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-22067", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-10-01T16:32:18.714554Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-129", "description": "CWE-129 Improper Validation of Array Index"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T14:41:07.897Z"}}], "cna": {"title": "spi: cadence: Fix out-of-bounds array access in cdns_mrvl_xspi_setup_clock()", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "26d34fdc49712ddbd42b11102f5d9d78a0f42097", "lessThan": "e50781bf7accc75883cb8a6a9921fb4e2fa8cca4", "versionType": "git"}, {"status": "affected", "version": "26d34fdc49712ddbd42b11102f5d9d78a0f42097", "lessThan": "c1fb84e274cb6a2bce6ba5e65116c06e0b3ab275", "versionType": "git"}, {"status": "affected", "version": "26d34fdc49712ddbd42b11102f5d9d78a0f42097", "lessThan": "645f1813fe0dc96381c36b834131e643b798fd73", "versionType": "git"}, {"status": "affected", "version": "26d34fdc49712ddbd42b11102f5d9d78a0f42097", "lessThan": "7ba0847fa1c22e7801cebfe5f7b75aee4fae317e", "versionType": "git"}], "programFiles": ["drivers/spi/spi-cadence-xspi.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.12"}, {"status": "unaffected", "version": "0", "lessThan": "6.12", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.23", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.13.11", "versionType": "semver", "lessThanOrEqual": "6.13.*"}, {"status": "unaffected", "version": "6.14.2", "versionType": "semver", "lessThanOrEqual": "6.14.*"}, {"status": "unaffected", "version": "6.15", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/spi/spi-cadence-xspi.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/e50781bf7accc75883cb8a6a9921fb4e2fa8cca4"}, {"url": "https://git.kernel.org/stable/c/c1fb84e274cb6a2bce6ba5e65116c06e0b3ab275"}, {"url": "https://git.kernel.org/stable/c/645f1813fe0dc96381c36b834131e643b798fd73"}, {"url": "https://git.kernel.org/stable/c/7ba0847fa1c22e7801cebfe5f7b75aee4fae317e"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: cadence: Fix out-of-bounds array access in cdns_mrvl_xspi_setup_clock()\n\nIf requested_clk > 128, cdns_mrvl_xspi_setup_clock() iterates over the\nentire cdns_mrvl_xspi_clk_div_list array without breaking out early,\ncausing 'i' to go beyond the array bounds.\n\nFix that by stopping the loop when it gets to the last entry, clamping\nthe clock to the minimum 6.25 MHz.\n\nFixes the following warning with an UBSAN kernel:\n\n vmlinux.o: warning: objtool: cdns_mrvl_xspi_setup_clock: unexpected end of section .text.cdns_mrvl_xspi_setup_clock"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.23", "versionStartIncluding": "6.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.13.11", "versionStartIncluding": "6.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.14.2", "versionStartIncluding": "6.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.15", "versionStartIncluding": "6.12"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T21:12:00.224Z"}}}, "cveMetadata": {"cveId": "CVE-2025-22067", "state": "PUBLISHED", "dateUpdated": "2026-05-11T21:12:00.224Z", "dateReserved": "2024-12-29T08:45:45.813Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-04-16T14:12:20.795Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/spi/spi-cadence-xspi.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e50781bf7accc75883cb8a6a9921fb4e2fa8cca4", "status": "affected", "version": "26d34fdc49712ddbd42b11102f5d9d78a0f42097", "versionType": "git"}, {"lessThan": "c1fb84e274cb6a2bce6ba5e65116c06e0b3ab275", "status": "affected", "version": "26d34fdc49712ddbd42b11102f5d9d78a0f42097", "versionType": "git"}, {"lessThan": "645f1813fe0dc96381c36b834131e643b798fd73", "status": "affected", "version": "26d34fdc49712ddbd42b11102f5d9d78a0f42097", "versionType": "git"}, {"lessThan": "7ba0847fa1c22e7801cebfe5f7b75aee4fae317e", "status": "affected", "version": "26d34fdc49712ddbd42b11102f5d9d78a0f42097", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/spi/spi-cadence-xspi.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.12"}, {"lessThan": "6.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.23", "versionType": "semver"}, {"lessThanOrEqual": "6.13.*", "status": "unaffected", "version": "6.13.11", "versionType": "semver"}, {"lessThanOrEqual": "6.14.*", "status": "unaffected", "version": "6.14.2", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.15", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "442B00D1-26AD-4DD9-B74A-E818807D3E2B", "versionEndExcluding": "6.12.23", "versionStartIncluding": "6.12", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E7E864B0-8C00-4679-BA55-659B4C9C3AD3", "versionEndExcluding": "6.13.11", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "FADAE5D8-4808-442C-B218-77B2CE8780A0", "versionEndExcluding": "6.14.2", "versionStartIncluding": "6.14", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: cadence: Fix out-of-bounds array access in cdns_mrvl_xspi_setup_clock()\n\nIf requested_clk > 128, cdns_mrvl_xspi_setup_clock() iterates over the\nentire cdns_mrvl_xspi_clk_div_list array without breaking out early,\ncausing 'i' to go beyond the array bounds.\n\nFix that by stopping the loop when it gets to the last entry, clamping\nthe clock to the minimum 6.25 MHz.\n\nFixes the following warning with an UBSAN kernel:\n\n vmlinux.o: warning: objtool: cdns_mrvl_xspi_setup_clock: unexpected end of section .text.cdns_mrvl_xspi_setup_clock"}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: spi: cadence: Se corrige el acceso fuera de los l\u00edmites a la matriz en cdns_mrvl_xspi_setup_clock(). Si request_clk > 128, cdns_mrvl_xspi_setup_clock() itera sobre toda la matriz cdns_mrvl_xspi_clk_div_list sin interrumpir la ejecuci\u00f3n antes de tiempo, lo que provoca que 'i' sobrepase los l\u00edmites de la matriz. Para solucionarlo, se detiene el bucle al llegar a la \u00faltima entrada y se fija el reloj al m\u00ednimo de 6,25 MHz. Se corrige la siguiente advertencia con un kernel UBSAN: vmlinux.o: advertencia: objtool: cdns_mrvl_xspi_setup_clock: fin inesperado de la secci\u00f3n .text.cdns_mrvl_xspi_setup_clock"}], "id": "CVE-2025-22067", "lastModified": "2026-06-17T08:44:58.443", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-22067", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-10-01T16:32:18.714554Z", "version": "2.0.3"}}]}, "published": "2025-04-16T15:16:00.907", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/645f1813fe0dc96381c36b834131e643b798fd73"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7ba0847fa1c22e7801cebfe5f7b75aee4fae317e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c1fb84e274cb6a2bce6ba5e65116c06e0b3ab275"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e50781bf7accc75883cb8a6a9921fb4e2fa8cca4"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-129"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-129"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: spi: cadence: Fix out-of-bounds array access in cdns_mrvl_xspi_setup_clock()", "id": "2360234", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2360234"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-129", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nspi: cadence: Fix out-of-bounds array access in cdns_mrvl_xspi_setup_clock()\nIf requested_clk > 128, cdns_mrvl_xspi_setup_clock() iterates over the\nentire cdns_mrvl_xspi_clk_div_list array without breaking out early,\ncausing 'i' to go beyond the array bounds.\nFix that by stopping the loop when it gets to the last entry, clamping\nthe clock to the minimum 6.25 MHz.\nFixes the following warning with an UBSAN kernel:\nvmlinux.o: warning: objtool: cdns_mrvl_xspi_setup_clock: unexpected end of section .text.cdns_mrvl_xspi_setup_clock"], "name": "CVE-2025-22067", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-04-16T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-22067\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-22067\nhttps://lore.kernel.org/linux-cve-announce/2025041609-CVE-2025-22067-dfb2@gregkh/T"], "threat_severity": "Important"}

{}