CVE-2025-38142

hwmon: (asus-ec-sensors) check sensor index in read_string()

State: Published
Severity: Not scored
Published: Jul 3, 2025
Updated: May 11, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (asus-ec-sensors) check sensor index in read_string()

Prevent a potential invalid memory access when the requested sensor is not found.

find_ec_sensor_index() may return a negative value (e.g. -ENOENT), but its result was used without checking, which could lead to undefined behavior when passed to get_sensor_info().

Add a proper check to return -EINVAL if sensor_index is negative.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

[groeck: Return error code returned from find_ec_sensor_index]

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	d0ddfd241e5719d696bc0b081e260db69d368668 to before 6bf529ce84dccc0074dbc704e70aee4aa545057eAffected d0ddfd241e5719d696bc0b081e260db69d368668 to before 4e9e45746b861ebd54c03ef301da2cb8fc990536Affected d0ddfd241e5719d696bc0b081e260db69d368668 to before 19bd9cde38dd4ca1771aed7afba623e7f4247c8eAffected d0ddfd241e5719d696bc0b081e260db69d368668 to before 7eeb3df6f07a886bdfd52757ede127a59a8784dcAffected d0ddfd241e5719d696bc0b081e260db69d368668 to before 25be318324563c63cbd9cb53186203a08d2f83a1Affected
LinuxLinux	5.18Affected before 5.18Not affected 6.1.142 through 6.1.Not affected 6.6.94 through 6.6.Not affected 6.12.34 through 6.12.Not affected 6.15.3 through 6.15.Not affected 6.16 and laterNot affected

Product

Versions

LinuxLinux

d0ddfd241e5719d696bc0b081e260db69d368668 to before 6bf529ce84dccc0074dbc704e70aee4aa545057eAffected
d0ddfd241e5719d696bc0b081e260db69d368668 to before 4e9e45746b861ebd54c03ef301da2cb8fc990536Affected
d0ddfd241e5719d696bc0b081e260db69d368668 to before 19bd9cde38dd4ca1771aed7afba623e7f4247c8eAffected
d0ddfd241e5719d696bc0b081e260db69d368668 to before 7eeb3df6f07a886bdfd52757ede127a59a8784dcAffected
d0ddfd241e5719d696bc0b081e260db69d368668 to before 25be318324563c63cbd9cb53186203a08d2f83a1Affected

LinuxLinux

5.18Affected
before 5.18Not affected
6.1.142 through 6.1.*Not affected
6.6.94 through 6.6.*Not affected
6.12.34 through 6.12.*Not affected
6.15.3 through 6.15.*Not affected
6.16 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.