Cloudanix VulnDB

CVE-2025-40356

None

CVSS

—

EPSS

0.1%

Published

Dec 16, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A memory handling mistake in a hardware driver for certain chips could trigger system warnings during normal operation and needs a software update to correct.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Data Tampering
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Driver incorrectly uses virt_to_phys instead of dma_map_single for DMA buffer mapping in rockchip-sfc SPI controller, violating DMA-API rules and triggering debug warnings on sync operations for unallocated memory regions.

Why it matters to the business

May cause kernel warnings, reduced stability during SPI NOR flash operations on affected Rockchip hardware, and potential operational issues in embedded or storage-related workloads; low exploitation risk but requires patching for compliance and reliability.

How an attack unfolds

An attacker with local access or control over SPI operations could trigger repeated DMA sync calls through normal flash reads, surfacing the debug warning path; no public exploits or threat actor usage observed.

How to fix it

Update to the fixed kernel commit 22810d4cb0e8a7d51b24527e73beac60afc1c693 or later stable releases; for listed Red Hat packages apply the referenced firefox updates if applicable in the environment.

How to confirm the fix worked

Rebuild with DMA-API debugging enabled and verify absence of the check_sync warning during spi_nor_sfdp_init and related probe sequences; confirm the driver source uses dma_map_single for transfer buffers.

Typical attack path

  1. Gain local execution or load a module that exercises spi_nor_probe paths
  2. Trigger spi_mem_exec_op leading to rockchip_sfc_exec_mem_op
  3. Invoke dma sync operations on improperly mapped buffers
  4. Observe or log the DMA-API warning in kernel debug output

How to detect it

Search kernel logs for the exact DMA-API warning string referencing rockchip-sfc and device address 0x000000000cf70000; inspect call traces containing rockchip_sfc_exec_mem_op and debug_dma_sync_single_for_cpu.

  • DMA-API: rockchip-sfc fe300000.spi: device driver tries to sync DMA memory it has not allocated
  • rockchip_sfc_exec_mem_op+0x4a0/0x798
  • debug_dma_sync_single_for_cpu+0x84/0x8c

What your security team should do

  • Prioritize kernel updates on Rockchip-based systems within standard maintenance windows
  • Enable DMA debug logging in test environments to validate the fix
  • Monitor for any downstream dependents using the affected spi_rockchip_sfc module

The record

In the Linux kernel, the following vulnerability has been resolved: spi: rockchip-sfc: Fix DMA-API usage Use DMA-API dma_map_single() call for getting the DMA address of the transfer buffer instead of hacking with virt_to_phys(). This fixes the following DMA-API debug warning: ------------[ cut here ]------------ DMA-API: rockchip-sfc fe300000.spi: device driver tries to sync DMA memory it has not allocated [device address=0x000000000cf70000] [size=288 bytes] WARNING: kernel/dma/debug.c:1106 at check_sync+0x1d8/0x690, CPU#2: systemd-udevd/151 Modules linked in: ... Hardware name: Hardkernel ODROID-M1 (DT) pstate: 604000c9 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : check_sync+0x1d8/0x690 lr : check_sync+0x1d8/0x690 .. Call trace: check_sync+0x1d8/0x690 (P) debug_dma_sync_single_for_cpu+0x84/0x8c __dma_sync_single_for_cpu+0x88/0x234 rockchip_sfc_exec_mem_op+0x4a0/0x798 [spi_rockchip_sfc] spi_mem_exec_op+0x408/0x498 spi_nor_read_data+0x170/0x184 spi_nor_read_sfdp+0x74/0xe4 spi_nor_parse_sfdp+0x120/0x11f0 spi_nor_sfdp_init_params_deprecated+0x3c/0x8c spi_nor_scan+0x690/0xf88 spi_nor_probe+0xe4/0x304 spi_mem_probe+0x6c/0xa8 spi_probe+0x94/0xd4 really_probe+0xbc/0x298 ...

Affected packages

Ecosystem Package Introduced Fixed
Linux Kernel 6.14.0 6.17.6

Related vulnerabilities