CVE-2025-39786

In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad7173: fix channels index for syscalib_mode Fix the index used to look up the channel when accessing the syscalib_mode attribute. The address field is a 0-based index (same as scan_index) that it used to access the channel in the ad7173_channels array throughout the driver. The channels field, on the other hand, may not match the address field depending on the channel configuration specified in the device tree and could result in an out-of-bounds access.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/0eb8d7b25397330beab8ee62c681975b79f37223	Patch
https://git.kernel.org/stable/c/2def1a8691eb43654da0ae0d2fdb3722e20262a5	Patch

Configurations

Configuration 1 (hide)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

History

19 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: iio: adc: ad7173: corregir el índice de canales para syscalib_mode Corregir el índice utilizado para buscar el canal al acceder al atributo syscalib_mode. El campo de dirección es un índice basado en 0 (igual que scan_index) que se utiliza para acceder al canal en el array ad7173_channels en todo el controlador. El campo de canales, por otro lado, puede no coincidir con el campo de dirección dependiendo de la configuración del canal especificada en el árbol de dispositivos y podría resultar en un acceso fuera de límites.

Information

Published : 2025-09-11 17:15

Updated : 2026-10-19 21:10

NVD link : CVE-2025-39786

Mitre link : CVE-2025-39786

CVE.ORG link : CVE-2025-39786

JSON object : View

Products Affected

linux

linux_kernel

CWE

CWE-125

Out-of-bounds Read

{"id": "CVE-2025-39786", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "031bdc8aee01b7b298159eee541844d8bff4467d", "lessThan": "2def1a8691eb43654da0ae0d2fdb3722e20262a5", "versionType": "git"}, {"status": "affected", "version": "031bdc8aee01b7b298159eee541844d8bff4467d", "lessThan": "0eb8d7b25397330beab8ee62c681975b79f37223", "versionType": "git"}], "programFiles": ["drivers/iio/adc/ad7173.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.14"}, {"status": "unaffected", "version": "0", "lessThan": "6.14", "versionType": "semver"}, {"status": "unaffected", "version": "6.16.4", "versionType": "semver", "lessThanOrEqual": "6.16.*"}, {"status": "unaffected", "version": "6.17", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/iio/adc/ad7173.c"], "defaultStatus": "affected"}]}], "published": "2025-09-11T17:15:44.770", "references": [{"url": "https://git.kernel.org/stable/c/0eb8d7b25397330beab8ee62c681975b79f37223", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/2def1a8691eb43654da0ae0d2fdb3722e20262a5", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: ad7173: fix channels index for syscalib_mode\n\nFix the index used to look up the channel when accessing the\nsyscalib_mode attribute. The address field is a 0-based index (same\nas scan_index) that it used to access the channel in the\nad7173_channels array throughout the driver. The channels field, on\nthe other hand, may not match the address field depending on the\nchannel configuration specified in the device tree and could result\nin an out-of-bounds access."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\niio: adc: ad7173: corregir el \u00edndice de canales para syscalib_mode\n\nCorregir el \u00edndice utilizado para buscar el canal al acceder al atributo syscalib_mode. El campo de direcci\u00f3n es un \u00edndice basado en 0 (igual que scan_index) que se utiliza para acceder al canal en el array ad7173_channels en todo el controlador. El campo de canales, por otro lado, puede no coincidir con el campo de direcci\u00f3n dependiendo de la configuraci\u00f3n del canal especificada en el \u00e1rbol de dispositivos y podr\u00eda resultar en un acceso fuera de l\u00edmites."}], "lastModified": "2026-10-19T21:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "193583C3-9388-4FFF-8341-D8DC6D763A1D", "versionEndExcluding": "6.16.4", "versionStartIncluding": "6.14"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}