CVE-2025-38142 hwmon: (asus-ec-sensors) check sensor index in read_string()
A missing check in the Linux kernel asus-ec-sensors driver allows invalid memory access, potentially causing a system crash.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-38142?
CVE-2025-38142 is a medium-severity vulnerability in Debian Debian Linux, published on 3 Jul 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (asus-ec-sensors) check sensor index in read_string()
Prevent a potential invalid memory access when the requested sensor is not found.
find_ec_sensor_index() may return a negative value (e.g. -ENOENT), but its result was used without checking, which could lead to undefined behavior when passed to get_sensor_info().
Add a proper check to return -EINVAL if sensor_index is negative.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
[groeck: Return error code returned from find_ec_sensor_index]
Weakness: CWE-476
Which versions are affected by CVE-2025-38142?
It affects 2 products.
Products include Debian Debian Linux, Linux kernel.
How do I fix CVE-2025-38142?
Apply the vendor's patch.
Is CVE-2025-38142 being exploited?
There is no known exploitation of CVE-2025-38142 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as AZL-64523, BELL-CVE-2025-38142, DEBIAN-CVE-2025-38142, GHSA-895c-6cgv-gh76, ROOT-OS-DEBIAN-12-CVE-2025-38142, ROOT-OS-UBUNTU-2404-CVE-2025-38142 and 1 more.