CVE-2025-40356: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-40356 is a DMA-API misuse vulnerability in the Linux kernel's spi: rockchip-sfc (Rockchip Serial Flash Controller) driver. The driver incorrectly used virt_to_phys() to obtain the DMA address of a transfer buffer instead of the proper dma_map_single() DMA-API call, triggering a kernel DMA-API debug warning. The vulnerability was published on December 16, 2025, and affects Linux kernel versions from commit b69386fcbc60 up to (but not including) the fix commits. Patched versions include Linux 6.17.6 and 6.18. No CVSS score has been assigned; the EPSS score is approximately 0.018% (Feedly, ENISA EUVD).

The root cause is improper DMA memory management (CWE-119 / improper buffer handling) in the rockchip_sfc_exec_mem_op() function of the spi-rockchip-sfc kernel driver. By using virt_to_phys() instead of dma_map_single(), the driver attempts to sync DMA memory that was never registered with the DMA subsystem, violating the DMA-API contract. This triggers a kernel warning from kernel/dma/debug.c at check_sync+0x1d8/0x690 during SPI NOR flash SFDP parameter parsing (e.g., during device probing on hardware such as the Hardkernel ODROID-M1). The fix replaces the incorrect address translation with a proper dma_map_single() call to correctly allocate and track the DMA mapping (Feedly).

The primary impact is a kernel stability issue: the improper DMA-API usage can cause undefined behavior in DMA operations on affected Rockchip SFC SPI devices, potentially leading to data corruption during SPI NOR flash read operations or system instability (kernel warnings/crashes) during device probing. Confidentiality and integrity of data transferred via the SPI flash controller may be affected on systems using the spi-rockchip-sfc driver. The vulnerability is limited in scope to embedded Linux systems using Rockchip SoCs with the affected SFC driver (e.g., ODROID-M1) and does not represent a remotely exploitable attack surface (Feedly).

There is no known public exploit code, no evidence of in-the-wild exploitation, and this vulnerability has not been added to the CISA KEV catalog. The EPSS score is approximately 0.018%, reflecting very low exploitation probability. The issue is a kernel driver bug requiring local access to an affected Rockchip-based system and is not exploitable remotely (Feedly).

The fix has been merged into the Linux stable kernel. Patched versions are Linux 6.17.6 and 6.18 (and later). The fix commits are 22810d4cb0e8a7d51b24527e73beac60afc1c693 (for the 6.17.x stable branch) and ee795e82e10197c070efd380dc9615c73dffad6c (for mainline/6.18). Users running affected Rockchip SFC-based systems should update to a patched kernel version. No configuration-based workaround is available; upgrading the kernel is the recommended remediation (ENISA EUVD, Feedly).