CVE-2025-38142: hwmon: (asus-ec-sensors) check sensor index in read_string()
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (asus-ec-sensors) check sensor index in readstring()
Prevent a potential invalid memory access when the requested sensor is not found.
findecsensorindex() may return a negative value (e.g. -ENOENT), but its result was used without checking, which could lead to undefined behavior when passed to getsensorinfo().
Add a proper check to return -EINVAL if sensorindex is negative.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
[groeck: Return error code returned from findecsensorindex]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
In hwmon (asus-ec-sensors) read_string(), check whether sensor_index is negative after find_ec_sensor_index(); return -EINVAL before passing it to get_sensor_info().
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38142?
CVE-2025-38142 is classified as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2025-38142?
To fix CVE-2025-38142, update to the latest stable version of the Linux kernel that addresses this vulnerability.
Which versions of Linux Kernel are affected by CVE-2025-38142?
CVE-2025-38142 affects multiple versions of the Linux kernel prior to the patches that remediate this issue.
What does CVE-2025-38142 exploit?
CVE-2025-38142 exploits a potential invalid memory access due to improper handling of sensor indices in the hwmon subsystem.
How can I verify if my system is impacted by CVE-2025-38142?
You can verify your system's vulnerability to CVE-2025-38142 by checking the kernel version and comparing it with the patched releases.