5.5

CVE-2025-38142

hwmon: (asus-ec-sensors) check sensor index in read_string()

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (asus-ec-sensors) check sensor index in read_string()

Prevent a potential invalid memory access when the requested sensor
is not found.

find_ec_sensor_index() may return a negative value (e.g. -ENOENT),
but its result was used without checking, which could lead to
undefined behavior when passed to get_sensor_info().

Add a proper check to return -EINVAL if sensor_index is negative.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

[groeck: Return error code returned from find_ec_sensor_index]
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 5.18 < 6.1.142
Linux ≫ Linux Kernel Version >= 6.2 < 6.6.94
Linux ≫ Linux Kernel Version >= 6.7 < 6.12.34
Linux ≫ Linux Kernel Version >= 6.13 < 6.15.3
Debian ≫ Debian Linux Version11.0
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.16% 0.051
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

https://git.kernel.org/stable/c/6bf529ce84dccc0074dbc704e70aee4aa545057e
Patch
https://git.kernel.org/stable/c/4e9e45746b861ebd54c03ef301da2cb8fc990536
Patch
https://git.kernel.org/stable/c/19bd9cde38dd4ca1771aed7afba623e7f4247c8e
Patch
https://git.kernel.org/stable/c/7eeb3df6f07a886bdfd52757ede127a59a8784dc
Patch
https://git.kernel.org/stable/c/25be318324563c63cbd9cb53186203a08d2f83a1
Patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
Third Party Advisory