UBUNTU-CVE-2025-40014: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: objtool, spi: amd: Fix out-of-bounds stack access in amdsetspifreq() If speedhz < AMDSPIMINHZ, amdsetspifreq() iterates over the entire amdspifreq array without breaking out early, causing 'i' to go beyond the array bounds. Fix that by stopping the loop when it gets to the last entry, so the low speedhz value gets clamped up to AMDSPIMINHZ. Fixes the following warning with an UBSAN kernel: drivers/spi/spi-amd.o: error: objtool: amdsetspifreq() falls through to next function amdspisetopcode()
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 6.8.0-147.147 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 6.8.0-1067.70 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 6.8.0-1071.79 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 6.8.0-1069.76 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 6.8.0-1071.79 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 6.8.0-1066.74 - Upgrade
Upgrade
ubuntu/linux-gkeopto a version that resolves this vulnerability.Fixed in 6.8.0-1052.56 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 6.8.0-1067.68 - Upgrade
Upgrade
ubuntu/linux-lowlatencyto a version that resolves this vulnerability.Fixed in 6.8.0-147.147.1 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 6.8.0-1064.67 - Upgrade
Upgrade
ubuntu/linux-bluefieldto a version that resolves this vulnerability.Fixed in 6.8.0-1033.38 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 6.8.1-1062.63 - Upgrade
Upgrade
ubuntu/linux-aws-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1067.70+fips1 - Upgrade
Upgrade
ubuntu/linux-azure-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1071.79+fips1 - Upgrade
Upgrade
ubuntu/linux-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-147.147+fips1 - Upgrade
Upgrade
ubuntu/linux-gcp-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1071.79+fips1 - Compensating control
In amd_set_spi_freq(), stop iterating when the last entry of the amd_spi_freq array is reached, so values where speed_hz < AMD_SPI_MIN_HZ are clamped up to AMD_SPI_MIN_HZ and the index cannot exceed the array bounds.
Event History
Frequently Asked Questions
What systems are exposed to this issue?
The affected Ubuntu kernel packages listed are linux-azure-fde, linux-riscv, linux-realtime, linux-hwe-edge, linux-azure, linux-gcp, linux-gke, and linux-gkeop. Exposure also depends on use of the AMD SPI driver path containing amd_set_spi_freq().
What condition triggers the out-of-bounds access?
The issue occurs when amd_set_spi_freq() receives a speed_hz value below AMD_SPI_MIN_HZ. The frequency-selection loop can then continue past the end of the amd_spi_freq array.
What does the fix do?
The fix stops the loop at the final frequency-table entry. Requests below the minimum supported frequency are clamped up to AMD_SPI_MIN_HZ instead of allowing the loop index to exceed the array bounds.