{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-38547","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-04-16T04:51:24.024Z","datePublished":"2025-08-16T11:34:15.905Z","dateUpdated":"2026-08-05T12:02:48.850Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T12:02:48.850Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps\n\nThe AXP717 ADC channel maps is missing a sentinel entry at the end. This\ncauses a KASAN warning.\n\nAdd the missing sentinel entry."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H","baseScore":7.3,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is `axp20x_probe()`, a platform-driver probe reached at boot or via local module load / sysfs driver bind on an AXP717-equipped board; there is no network, adjacent-network, or physical-insertion path since the PMIC is soldered on-board.\nAC:L - The missing sentinel is unconditional — every probe of the axp717-adc cell deterministically runs the out-of-bounds walk past `axp717_maps[]`; there is no race to win and no state the attacker must wait for.\nPR:L - The out-of-bounds read and the poisoning of the global `iio_map_list` happen during normal boot-time probe without any privileged operation being performed, so an unprivileged local user is exposed to the corrupted state without holding any capability.\nUI:N - The bug fires automatically when the MFD core instantiates the axp717-adc cell during boot; no victim action, mount, or file open is needed.\nS:U - The out-of-bounds read, the corrupted global list, and the resulting wild-pointer dereference all occur within the kernel's own security authority with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - This is an unbounded global out-of-bounds read that walks forward through kernel `.data` until it chances upon a NULL, and the OOB-derived pointers are then dereferenced as strings by `strcmp()` in `iio_channel_get_sys()`/`iio_channel_get_all()`, reading arbitrary kernel memory rather than a strictly bounded few bytes.\nI:L - The bug permanently injects bogus entries built from out-of-bounds memory into the global `iio_map_list` and propagates a garbage `consumer_data` pointer to consumer drivers, corrupting kernel state; it is limited rather than High because the array is only read — there is no out-of-bounds write or control-flow-hijack primitive on this path.\nA:H - The registered garbage entries carry non-string values (e.g. `struct platform_driver` function pointers or arbitrary `.data` words) that `strcmp()` later dereferences, producing an oops or panic, and on a KASAN kernel the global-out-of-bounds report itself panics under `panic_on_warn`."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/iio/adc/axp20x_adc.c"],"versions":[{"version":"5ba0cb92584ba5e107c97001e09013c1da0772a8","lessThan":"086a76474121bf2351438e311376ec67b410b2ea","status":"affected","versionType":"git"},{"version":"5ba0cb92584ba5e107c97001e09013c1da0772a8","lessThan":"0c0c01c88bb69951539539d2001e67f0c613001f","status":"affected","versionType":"git"},{"version":"5ba0cb92584ba5e107c97001e09013c1da0772a8","lessThan":"3281ddcea6429f7bc1fdb39d407752dd1371aba9","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/iio/adc/axp20x_adc.c"],"versions":[{"version":"6.12","status":"affected"},{"version":"0","lessThan":"6.12","status":"unaffected","versionType":"semver"},{"version":"6.12.40","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.15.8","lessThanOrEqual":"6.15.*","status":"unaffected","versionType":"semver"},{"version":"6.16","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12","versionEndExcluding":"6.12.40"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12","versionEndExcluding":"6.15.8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12","versionEndExcluding":"6.16"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/086a76474121bf2351438e311376ec67b410b2ea"},{"url":"https://git.kernel.org/stable/c/0c0c01c88bb69951539539d2001e67f0c613001f"},{"url":"https://git.kernel.org/stable/c/3281ddcea6429f7bc1fdb39d407752dd1371aba9"}],"title":"iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps","x_generator":{"engine":"bippy-1.2.0"}}}}