CVE-2025-39921

spi: microchip-core-qspi: stop checking viability of op->max_freq in supports_op callback

State
Published
Severity
5.5 Medium
Published
Oct 1, 2025
Updated
Oct 21, 2026
Reserved
Apr 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

spi: microchip-core-qspi: stop checking viability of op->max_freq in supports_op callback

In commit 13529647743d9 ("spi: microchip-core-qspi: Support per spi-mem operation frequency switches") the logic for checking the viability of op->max_freq in mchp_coreqspi_setup_clock() was copied into mchp_coreqspi_supports_op(). Unfortunately, op->max_freq is not valid when this function is called during probe but is instead zero. Accordingly, baud_rate_val is calculated to be INT_MAX due to division by zero, causing probe of the attached memory device to fail.

Seemingly spi-microchip-core-qspi was the only driver that had such a modification made to its supports_op callback when the per_op_freq capability was added, so just remove it to restore prior functionality.

Scores

CVSSScoreVectorSource
3.15.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HCISA-ADP

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • d29f749d5202605dbb7480791e6841487d8afb77 to before 4ad071e3d57967f7ab483aed0687468bc1d9e9ceAffected
  • 13529647743d906ed3cf991f1d77727e7ff1fb6f to before ac8a13f35d5b8996582b3f97b924838a5c570c18Affected
  • 13529647743d906ed3cf991f1d77727e7ff1fb6f to before 89e7353f522f5cf70cb48c01ce2dcdcb275b8022Affected
LinuxLinux
  • 6.14Affected
  • before 6.14Not affected
  • 6.16.6 through 6.16.*Not affected
  • 6.17 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.