CVE-2025-21656: hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur
First published: Tue Jan 21 2025(Updated: )
In the Linux kernel, the following vulnerability has been resolved: hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur scsi_execute_cmd() function can return both negative (linux codes) and positive (scsi_cmnd result field) error codes. Currently the driver just passes error codes of scsi_execute_cmd() to hwmon core, which is incorrect because hwmon only checks for negative error codes. This leads to hwmon reporting uninitialized data to userspace in case of SCSI errors (for example if the disk drive was disconnected). This patch checks scsi_execute_cmd() output and returns -EIO if it's error code is positive. [groeck: Avoid inline variable declaration for portability]
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Red Hat Kernel-devel |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-21656?
CVE-2025-21656 has a medium severity rating due to its impact on data integrity during SCSI operations.
What versions of the Linux Kernel are affected by CVE-2025-21656?
CVE-2025-21656 affects certain versions of the Linux Kernel that utilize the drivetemp hwmon driver.
How do I fix CVE-2025-21656?
To fix CVE-2025-21656, update your Linux Kernel to the latest patched version available from your distribution.
What kind of errors does CVE-2025-21656 address?
CVE-2025-21656 addresses SCSI execution errors that can result in inaccurate data being reported by the drivetemp driver.
Is CVE-2025-21656 a serious risk for Linux systems?
While CVE-2025-21656 is classified as medium severity, it poses a risk to systems relying on accurate SCSI data reporting.
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/title
- agent/first-publish-date
- agent/description
- agent/type
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/author
- agent/event
- agent/source
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/linux
- canonical/red hat kernel-devel