CVE-2025-39788
Gravedad:
Pendiente de análisis
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
11/09/2025
Última modificación:
11/09/2025
Descripción
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE<br />
<br />
On Google gs101, the number of UTP transfer request slots (nutrs) is 32,<br />
and in this case the driver ends up programming the UTRL_NEXUS_TYPE<br />
incorrectly as 0.<br />
<br />
This is because the left hand side of the shift is 1, which is of type<br />
int, i.e. 31 bits wide. Shifting by more than that width results in<br />
undefined behaviour.<br />
<br />
Fix this by switching to the BIT() macro, which applies correct type<br />
casting as required. This ensures the correct value is written to<br />
UTRL_NEXUS_TYPE (0xffffffff on gs101), and it also fixes a UBSAN shift<br />
warning:<br />
<br />
UBSAN: shift-out-of-bounds in drivers/ufs/host/ufs-exynos.c:1113:21<br />
shift exponent 32 is too large for 32-bit type &#39;int&#39;<br />
<br />
For consistency, apply the same change to the nutmrs / UTMRL_NEXUS_TYPE<br />
write.
Impacto
Referencias a soluciones, herramientas e información
- https://git.kernel.org/stable/c/01510a9e8222f11cce064410f3c2fcf0756c0a08
- https://git.kernel.org/stable/c/01aad16c2257ab8ff33b152b972c9f2e1af47912
- https://git.kernel.org/stable/c/098b2c8ee208c77126839047b9e6e1925bb35baa
- https://git.kernel.org/stable/c/5b9f1ef293428ea9c0871d96fcec2a87c4445832
- https://git.kernel.org/stable/c/6d53b2a134da77eb7fe65c5c7c7a3c193539a78a
- https://git.kernel.org/stable/c/c1f025da8f370a015e412b55cbcc583f91de8316
- https://git.kernel.org/stable/c/dc8fb963742f1a38d284946638f9358bdaa0ddee