{"id":"CVE-2025-38547","state":"PUBLISHED","title":"iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps","description":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps\n\nThe AXP717 ADC channel maps is missing a sentinel entry at the end. This\ncauses a KASAN warning.\n\nAdd the missing sentinel entry.","publishedAt":"2025-08-16T11:34:15.905Z","updatedAt":"2026-08-05T12:02:48.850Z","severity":{"score":7.3,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"5ba0cb92584ba5e107c97001e09013c1da0772a8","status":"affected","lessThan":"086a76474121bf2351438e311376ec67b410b2ea","versionType":"git"},{"version":"5ba0cb92584ba5e107c97001e09013c1da0772a8","status":"affected","lessThan":"0c0c01c88bb69951539539d2001e67f0c613001f","versionType":"git"},{"version":"5ba0cb92584ba5e107c97001e09013c1da0772a8","status":"affected","lessThan":"3281ddcea6429f7bc1fdb39d407752dd1371aba9","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/iio/adc/axp20x_adc.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.12","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.12","versionType":"semver"},{"version":"6.12.40","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.15.8","status":"unaffected","lessThanOrEqual":"6.15.*","versionType":"semver"},{"version":"6.16","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/iio/adc/axp20x_adc.c"]}],"references":["https://git.kernel.org/stable/c/086a76474121bf2351438e311376ec67b410b2ea","https://git.kernel.org/stable/c/0c0c01c88bb69951539539d2001e67f0c613001f","https://git.kernel.org/stable/c/3281ddcea6429f7bc1fdb39d407752dd1371aba9"],"weaknesses":[],"ingestedAt":"2026-10-29T20:09:09.358Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/38xxx/CVE-2025-38547.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-38547","state":"PUBLISHED","datePublished":"2025-08-16T11:34:15.905Z","dateUpdated":"2026-08-05T12:02:48.850Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-04-16T04:51:24.024Z"},"containers":{"cna":{"title":"iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps\n\nThe AXP717 ADC channel maps is missing a sentinel entry at the end. This\ncauses a KASAN warning.\n\nAdd the missing sentinel entry."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"5ba0cb92584ba5e107c97001e09013c1da0772a8","status":"affected","lessThan":"086a76474121bf2351438e311376ec67b410b2ea","versionType":"git"},{"version":"5ba0cb92584ba5e107c97001e09013c1da0772a8","status":"affected","lessThan":"0c0c01c88bb69951539539d2001e67f0c613001f","versionType":"git"},{"version":"5ba0cb92584ba5e107c97001e09013c1da0772a8","status":"affected","lessThan":"3281ddcea6429f7bc1fdb39d407752dd1371aba9","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/iio/adc/axp20x_adc.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.12","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.12","versionType":"semver"},{"version":"6.12.40","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.15.8","status":"unaffected","lessThanOrEqual":"6.15.*","versionType":"semver"},{"version":"6.16","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/iio/adc/axp20x_adc.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/086a76474121bf2351438e311376ec67b410b2ea"},{"url":"https://git.kernel.org/stable/c/0c0c01c88bb69951539539d2001e67f0c613001f"},{"url":"https://git.kernel.org/stable/c/3281ddcea6429f7bc1fdb39d407752dd1371aba9"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H","baseScore":7.3,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is `axp20x_probe()`, a platform-driver probe reached at boot or via local module load / sysfs driver bind on an AXP717-equipped board; there is no network, adjacent-network, or physical-insertion path since the PMIC is soldered on-board.\nAC:L - The missing sentinel is unconditional — every probe of the axp717-adc cell deterministically runs the out-of-bounds walk past `axp717_maps[]`; there is no race to win and no state the attacker must wait for.\nPR:L - The out-of-bounds read and the poisoning of the global `iio_map_list` happen during normal boot-time probe without any privileged operation being performed, so an unprivileged local user is exposed to the corrupted state without holding any capability.\nUI:N - The bug fires automatically when the MFD core instantiates the axp717-adc cell during boot; no victim action, mount, or file open is needed.\nS:U - The out-of-bounds read, the corrupted global list, and the resulting wild-pointer dereference all occur within the kernel's own security authority with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - This is an unbounded global out-of-bounds read that walks forward through kernel `.data` until it chances upon a NULL, and the OOB-derived pointers are then dereferenced as strings by `strcmp()` in `iio_channel_get_sys()`/`iio_channel_get_all()`, reading arbitrary kernel memory rather than a strictly bounded few bytes.\nI:L - The bug permanently injects bogus entries built from out-of-bounds memory into the global `iio_map_list` and propagates a garbage `consumer_data` pointer to consumer drivers, corrupting kernel state; it is limited rather than High because the array is only read — there is no out-of-bounds write or control-flow-hijack primitive on this path.\nA:H - The registered garbage entries carry non-string values (e.g. `struct platform_driver` function pointers or arbitrary `.data` words) that `strcmp()` later dereferences, producing an oops or panic, and on a KASAN kernel the global-out-of-bounds report itself panics under `panic_on_warn`."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T12:02:48.850Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12","versionEndExcluding":"6.12.40"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12","versionEndExcluding":"6.15.8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12","versionEndExcluding":"6.16"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}