CVE-2025-22067 spi: cadence: Fix out-of-bounds array access in cdns_mrvl_xspi_setup_clock()
An out-of-bounds array access in the Cadence SPI driver can cause a kernel crash when configuring clocks with high frequency values.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-22067?
CVE-2025-22067 is a high-severity vulnerability in Linux kernel, published on 16 Apr 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
spi: cadence: Fix out-of-bounds array access in cdns_mrvl_xspi_setup_clock()
If requested_clk > 128, cdns_mrvl_xspi_setup_clock() iterates over the entire cdns_mrvl_xspi_clk_div_list array without breaking out early, causing 'i' to go beyond the array bounds.
Fix that by stopping the loop when it gets to the last entry, clamping the clock to the minimum 6.25 MHz.
Fixes the following warning with an UBSAN kernel:
vmlinux.o: warning: objtool: cdns_mrvl_xspi_setup_clock: unexpected end of section .text.cdns_mrvl_xspi_setup_clock
Weakness: CWE-129
Which versions are affected by CVE-2025-22067?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-22067?
Apply the vendor's patch.
Is CVE-2025-22067 being exploited?
There is no known exploitation of CVE-2025-22067 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-22067, DEBIAN-CVE-2025-22067, GHSA-9gvx-7g99-qp7r, UBUNTU-CVE-2025-22067.