CVE-2025-39921: spi: microchip-core-qspi: stop checking viability of op->max_freq in supports_op callback
In the Linux kernel, the following vulnerability has been resolved:
spi: microchip-core-qspi: stop checking viability of op->maxfreq in supportsop callback
In commit 13529647743d9 ("spi: microchip-core-qspi: Support per spi-mem operation frequency switches") the logic for checking the viability of op->maxfreq in mchpcoreqspisetupclock() was copied into mchpcoreqspisupportsop(). Unfortunately, op->maxfreq is not valid when this function is called during probe but is instead zero. Accordingly, baudrateval is calculated to be INTMAX due to division by zero, causing probe of the attached memory device to fail.
Seemingly spi-microchip-core-qspi was the only driver that had such a modification made to its supportsop callback when the peropfreq capability was added, so just remove it to restore prior functionality.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-39921?
CVE-2025-39921 has been classified with a severity rating that indicates the potential for exploitation may impact system stability.
How do I fix CVE-2025-39921?
To fix CVE-2025-39921, update your Linux kernel to the latest version that includes the patch for this vulnerability.
What components are affected by CVE-2025-39921?
CVE-2025-39921 affects the microchip-core-qspi component of the Linux kernel.
Can CVE-2025-39921 be exploited remotely?
CVE-2025-39921 does not explicitly state remote exploitation capabilities, but vulnerability could potentially lead to local privilege escalation.
When was CVE-2025-39921 published?
CVE-2025-39921 was published as part of ongoing updates to the Linux kernel addressing various vulnerabilities.