ACK: [SRU][N][PATCH 0/1] CVE-2025-40014

[Edoardo Canepa]

Acked-by: Edoardo Canepa <edoardo.canepa at canonical.com>

On 9/9/26 22:13, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2025-40014
>
> [ Impact ]
>
> In the Linux kernel, the following vulnerability has been resolved:
>
> objtool, spi: amd: Fix out-of-bounds stack access in amd_set_spi_freq()
>
> If speed_hz < AMD_SPI_MIN_HZ, amd_set_spi_freq() iterates over the entire
> amd_spi_freq array without breaking out early, causing 'i' to go beyond the
> array bounds.
>
> Fix that by stopping the loop when it gets to the last entry, so the low
> speed_hz value gets clamped up to AMD_SPI_MIN_HZ.
>
> Fixes the following warning with an UBSAN kernel:
>
> drivers/spi/spi-amd.o: error: objtool: amd_set_spi_freq() falls through to next
> function amd_spi_set_opcode()
>
> [ Fix ]
>
> noble/linux: backported from 76e51db43fe4
>
> [ Test Plan ]
>
> Build and boot tested.
>
> [ Where Problems Could Occur ]
>
> A bad fix would affect systems using the AMD SPI controller driver
> (drivers/spi/spi-amd.c), which is found on AMD platforms that expose an SPI
> master through this driver. Since the change alters the frequency clamping
> logic for the AMD_SPI_MIN_HZ lower bound, a regression could cause SPI
> devices attached to that controller to be programmed at an incorrect clock
> rate. Systems without AMD SPI hardware, or that do not use this driver, are
> not affected by this change.
>
> [ Other Info ]
>
> Kybele flow-v11-25-ga27c0fa6. Reference: e0a0e79f/v1
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260915/2929a3d5/attachment.sig>