CVE-2025-22044

What it actually does

Narrowing conversion from u64 to int in acpi_nfit_ctl bypasses the non-zero check on call_pkg->nd_family when lower 32 bits are zero, allowing invalid values to reach to_nfit_bus_uuid and trigger warnings or undefined behavior instead of immediate EINVAL.

Why it matters to the business

Can cause kernel warnings or instability on systems using NVDIMM/ACPI NFIT, increasing operational risk for affected Linux deployments until patched.

How an attack unfolds

An attacker invokes acpi_nfit_ctl with a crafted u64 nd_family value that is non-zero overall but becomes zero after narrowing to int, evading the initial validation and passing an invalid family identifier downstream.

How to fix it

Apply the upstream fix in commit 4b65cff06a004ac54f6ea8886060f0d07b1ca055; ensure all input checks operate on the original u64 call_pkg->nd_family before any cast and return EINVAL for invalid values. Update affected packages to the listed fixed versions where applicable.

How to confirm the fix worked

Confirm the patch by inspecting acpi_nfit_ctl for direct u64 checks and immediate EINVAL returns; test boundary cases including values with high bits set and low bits zero.

Typical attack path

1. Locate exposure to acpi_nfit_ctl via NVDIMM user interfaces
2. Craft nd_family value with high bits set and low 32 bits zero
3. Submit the value through the ACPI NFIT control path
4. Bypass validation and trigger invalid family handling or warning

How to detect it

Search kernel logs for the warning string "only secondary bus families can be translated" and review audit trails around acpi_nfit_ctl invocations for anomalous nd_family values.

What your security team should do

• Prioritize kernel updates containing the referenced commit
• Review and restrict untrusted access to NVDIMM/ACPI NFIT interfaces
• Monitor kernel logs for the specific family translation warning