CVE-2025-39786 (GCVE-0-2025-39786)

Vulnerability from cvelistv5 – Published: 2025-09-11 16:56 – Updated: 2026-08-05 12:05
VLAI
Title
iio: adc: ad7173: fix channels index for syscalib_mode
Summary
In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad7173: fix channels index for syscalib_mode Fix the index used to look up the channel when accessing the syscalib_mode attribute. The address field is a 0-based index (same as scan_index) that it used to access the channel in the ad7173_channels array throughout the driver. The channels field, on the other hand, may not match the address field depending on the channel configuration specified in the device tree and could result in an out-of-bounds access.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 031bdc8aee01b7b298159eee541844d8bff4467d , < 2def1a8691eb43654da0ae0d2fdb3722e20262a5 (git)
Affected: 031bdc8aee01b7b298159eee541844d8bff4467d , < 0eb8d7b25397330beab8ee62c681975b79f37223 (git)
Create a notification for this product.
Linux Linux Affected: 6.14
Unaffected: 0 , < 6.14 (semver)
Unaffected: 6.16.4 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iio/adc/ad7173.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2def1a8691eb43654da0ae0d2fdb3722e20262a5",
              "status": "affected",
              "version": "031bdc8aee01b7b298159eee541844d8bff4467d",
              "versionType": "git"
            },
            {
              "lessThan": "0eb8d7b25397330beab8ee62c681975b79f37223",
              "status": "affected",
              "version": "031bdc8aee01b7b298159eee541844d8bff4467d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iio/adc/ad7173.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.4",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: ad7173: fix channels index for syscalib_mode\n\nFix the index used to look up the channel when accessing the\nsyscalib_mode attribute. The address field is a 0-based index (same\nas scan_index) that it used to access the channel in the\nad7173_channels array throughout the driver. The channels field, on\nthe other hand, may not match the address field depending on the\nchannel configuration specified in the device tree and could result\nin an out-of-bounds access."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached purely through the IIO sysfs interface (`/sys/bus/iio/devices/iio:deviceN/in_voltageX-voltageY_sys_calibrat ion_mode`) on the local system. No network or physical bus access is needed \u2014 the attacker only needs to read/write a local sysfs file.\nAC:L - A single deterministic sysfs read or write triggers the out-of-bounds access; there is no race, no timing element, and no dependence on memory layout to reach the bug. The out-of-range index is baked in by ordinary device-tree configurations \u2014 the driver\u0027s own binding example (`diff-channels = \u003c0 1\u003e,\u003c2 3\u003e,\u003c4 5\u003e,\u003c6 7\u003e,\u003c8 9\u003e`) already yields indices 6 and 8 into a 6-element array.\nPR:L - `sys_calibration_mode` is created with mode 0644 by `__iio_device_attr_init()`, so any unprivileged local user can trigger the out-of-bounds heap read; the paired store handler gives the out-of-bounds write, which on the industrial/embedded deployments using this ADC is commonly delegated to a non-root calibration daemon via udev rules. No real root in the init namespace is required to reach the vulnerable code.\nUI:N - The attacker acts entirely on their own by opening the sysfs attribute; no victim action, mount, or device plug-in is required. The affected ADC is a permanently attached SPI device enumerated at boot.\nS:U - The out-of-bounds access corrupts and discloses adjacent kernel slab memory within the same kernel security authority. There is no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The read path indexes up to 22 elements (\u2248548 bytes) past a heap allocation that can be as small as 24 bytes, reading bytes belonging to neighbouring slab objects and exposing their state through the enum attribute. Combined with heap grooming to place chosen objects adjacent to the `devm_kcalloc()` allocation, this leaks kernel heap contents.\nI:H - `ad7173_set_syscalib_mode()` performs an out-of-bounds *write* of a controlled 0/1 byte hundreds of bytes past the array, silently corrupting a live adjacent kernel slab object. A targeted single-byte heap overwrite of a neighbouring object\u0027s field is a classic primitive for escalating to control-flow hijack.\nA:H - Corrupting an adjacent slab object with the out-of-bounds write causes kernel oops/panic when that object is next used, and on CONFIG_KASAN or hardened builds the out-of-bounds access alone produces a splat that panics under `panic_on_warn`. The condition is repeatable at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:05:07.581Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2def1a8691eb43654da0ae0d2fdb3722e20262a5"
        },
        {
          "url": "https://git.kernel.org/stable/c/0eb8d7b25397330beab8ee62c681975b79f37223"
        }
      ],
      "title": "iio: adc: ad7173: fix channels index for syscalib_mode",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39786",
    "datePublished": "2025-09-11T16:56:35.706Z",
    "dateReserved": "2025-04-16T07:20:57.131Z",
    "dateUpdated": "2026-08-05T12:05:07.581Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-39786",
      "date": "2026-08-05",
      "epss": "0.00133",
      "percentile": "0.03256"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-39786\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-09-11T17:15:44.770\",\"lastModified\":\"2026-07-30T06:23:45.110\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\niio: adc: ad7173: fix channels index for syscalib_mode\\n\\nFix the index used to look up the channel when accessing the\\nsyscalib_mode attribute. The address field is a 0-based index (same\\nas scan_index) that it used to access the channel in the\\nad7173_channels array throughout the driver. The channels field, on\\nthe other hand, may not match the address field depending on the\\nchannel configuration specified in the device tree and could result\\nin an out-of-bounds access.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/iio/adc/ad7173.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"031bdc8aee01b7b298159eee541844d8bff4467d\",\"lessThan\":\"2def1a8691eb43654da0ae0d2fdb3722e20262a5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"031bdc8aee01b7b298159eee541844d8bff4467d\",\"lessThan\":\"0eb8d7b25397330beab8ee62c681975b79f37223\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/iio/adc/ad7173.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16.4\",\"lessThanOrEqual\":\"6.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.14\",\"versionEndExcluding\":\"6.16.4\",\"matchCriteriaId\":\"193583C3-9388-4FFF-8341-D8DC6D763A1D\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0eb8d7b25397330beab8ee62c681975b79f37223\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2def1a8691eb43654da0ae0d2fdb3722e20262a5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:21:37+00:00",
      "cve": "CVE-2025-39786",
      "id": "CVE-2025-39786",
      "initial_release_date": "2025-09-11T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: iio: adc: ad7173: fix channels index for syscalib_mode",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-39786.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.