CVE-2025-21793

What it actually does

Division by zero in spi-nor command handling when dummy bus cycle bytes and width are both zero, triggering CPU warnings or undefined behavior during SPI flash operations.

Why it matters to the business

Kernel instability or crashes on systems using affected SPI NOR flash controllers can interrupt boot processes, storage operations, or embedded device functionality, requiring urgent patching across Linux deployments.

How an attack unfolds

An attacker with local access or the ability to trigger specific SPI-NOR commands without dummy cycles can induce the division-by-zero condition, potentially leading to a kernel warning or crash; no widespread remote exploitation paths are known.

How to fix it

Update the Linux kernel to a version containing commit 966328191b4c389c0f2159fa242915f51cbc1679 or later stable releases that include the division-by-zero fix in the spi-nor driver.

How to confirm the fix worked

Verify the kernel source contains the fix commit or test SPI-NOR command paths with zero dummy cycles to confirm no division occurs and no warnings are emitted.

Typical attack path

1. Identify a target system using the vulnerable spi-nor driver with SPI flash lacking dummy cycles
2. Trigger SPI-NOR commands that set both dummy bus cycle bytes and width to zero
3. Force the division operation in the driver code to trigger the warning or fault
4. Observe or leverage resulting kernel instability for denial of service or further local attacks

How to detect it

Review kernel logs for division-by-zero warnings or oops in spi-nor paths; examine dmesg or syslog for SPI command handling faults on affected hardware.

What your security team should do

• Prioritize kernel updates on all systems using spi-nor drivers, especially embedded and server platforms
• Monitor for kernel oops or warnings related to division by zero in spi-nor code
• Apply the fix commit or upgrade to patched stable branches within standard maintenance windows