CVE-2025-38142 Details
Description
In the Linux kernel, the following vulnerability has been resolved: hwmon: (asus-ec-sensors) check sensor index in read_string() Prevent a potential invalid memory access when the requested sensor is not found. find_ec_sensor_index() may return a negative value (e.g. -ENOENT), but its result was used without checking, which could lead to undefined behavior when passed to get_sensor_info(). Add a proper check to return -EINVAL if sensor_index is negative. Found by Linux Verification Center (linuxtesting.org) with SVACE. [groeck: Return error code returned from find_ec_sensor_index]
A vulnerability in the Linux kernel's hardware monitoring (hwmon) subsystem, specifically within the asus-ec-sensors, has been addressed. The issue arose in the read_string() function, where the sensor index was not properly validated before use. This lack of validation could lead to invalid memory access if the requested sensor was not found, potentially causing undefined behavior. The find_ec_sensor_index() function may return a negative value, such as -ENOENT, but this was not checked before being passed to get_sensor_info(). The vulnerability has been resolved by adding a proper check to return -EINVAL if the sensor index is negative.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/19bd9cde38dd4ca1771aed7afba623e7f4247c8e | kernel.org | Patch |
| https://git.kernel.org/stable/c/25be318324563c63cbd9cb53186203a08d2f83a1 | kernel.org | Patch |
| https://git.kernel.org/stable/c/4e9e45746b861ebd54c03ef301da2cb8fc990536 | kernel.org | Patch |
| https://git.kernel.org/stable/c/6bf529ce84dccc0074dbc704e70aee4aa545057e | kernel.org | Patch |
| https://git.kernel.org/stable/c/7eeb3df6f07a886bdfd52757ede127a59a8784dc | kernel.org | Patch |
| https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html | CVE | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 5.18, < 6.1.142 >= 6.2, < 6.6.94 >= 6.7, < 6.12.34 >= 6.13, < 6.15.3 |
CPE
Remediation
| |
| debian debian linux | 11.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Dec 18, 2025 | Initial Analysis | [email protected] |
| Nov 3, 2025 | CVE Modified | CVE |
| Jul 3, 2025 | New CVE Received | kernel.org |