CVE-2025-39788: scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE
In the Linux kernel, the following vulnerability has been resolved:
scsi: ufs: exynos: Fix programming of HCIUTRLNEXUSTYPE
On Google gs101, the number of UTP transfer request slots (nutrs) is 32, and in this case the driver ends up programming the UTRLNEXUSTYPE incorrectly as 0.
This is because the left hand side of the shift is 1, which is of type int, i.e. 31 bits wide. Shifting by more than that width results in undefined behaviour.
Fix this by switching to the BIT() macro, which applies correct type casting as required. This ensures the correct value is written to UTRLNEXUSTYPE (0xffffffff on gs101), and it also fixes a UBSAN shift warning:
UBSAN: shift-out-of-bounds in drivers/ufs/host/ufs-exynos.c:1113:21 shift exponent 32 is too large for 32-bit type 'int'
For consistency, apply the same change to the nutmrs / UTMRLNEXUSTYPE write.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
In drivers/ufs/host/ufs-exynos.c, replace the left-shift expressions used to program UTRL_NEXUS_TYPE and UTMRL_NEXUS_TYPE with the BIT() macro so the shift uses the correct type and avoids the shift exponent 32 UBSAN warning.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-39788?
CVE-2025-39788 is classified as a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2025-39788?
To fix CVE-2025-39788, update your Linux kernel to the latest version where this vulnerability has been patched.
Which systems are affected by CVE-2025-39788?
CVE-2025-39788 affects the Linux kernel used on devices that implement SCSI and UFS protocols, particularly on Google gs101.
What are the potential impacts of CVE-2025-39788?
The potential impacts of CVE-2025-39788 include incorrect programming of UTRL_NEXUS_TYPE, which may affect data transfer operations.
Is CVE-2025-39788 being actively exploited?
As of now, there are no public reports indicating that CVE-2025-39788 is being actively exploited in the wild.