ACK: [SRU][J][PATCH 0/1] CVE-2025-21656

[Ivan Hu]

Acked-by: Ivan Hu <ivan.hu at canonical.com>

On Wed, Sep 30, 2026 at 6:27 AM Rickey Castillo via kernel-team <
kernel-team at lists.ubuntu.com> wrote:

> https://ubuntu.com/security/CVE-2025-21656
>
> [ Impact ]
>
> In the Linux kernel, the following vulnerability has been resolved:
>
> hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur
> scsi_execute_cmd() function can return both negative (linux codes) and
> positive (scsi_cmnd result field) error codes.
> Currently the driver just passes error codes of scsi_execute_cmd() to
> hwmon core, which is incorrect because hwmon only checks for negative
> error codes. This leads to hwmon reporting uninitialized data to
> userspace in case of SCSI errors (for example if the disk drive was
> disconnected).
> This patch checks scsi_execute_cmd() output and returns -EIO if it’s
> error code is positive.
>
> [ Fix ]
>
> backported from 82163d63ae7a ("hwmon: (drivetemp) Fix driver producing
> garbage data when SCSI errors occur"). Fixed conflict in drivetemp.c due
> to
> upstream API migration. Kernel 5.15 still uses scsi_execute_req() and
> data_dir
> variables instead of the newer scsi_execute_cmd() and enum req_op.
>
> [ Test Plan ]
>
> Build and boot tested.
>
> [ Where Problems Could Occur ]
>
> The patch is isolated cleanly to drivers/hwmon/drivetemp.c and does not
> leak
> into global storage stacks, meaning the risk of breaking system-wide disk
> stability or causing kernel panics is low.
>
> Daniil Stas (1):
>   hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors
>     occur
>
>  drivers/hwmon/drivetemp.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
>
> --
> 2.53.0
>
>
> --
> kernel-team mailing list
> kernel-team at lists.ubuntu.com
> https://lists.ubuntu.com/mailman/listinfo/kernel-team
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20261002/70aa3844/attachment-0001.html>