Improper Validation of Array Index Affecting linux-virt-doc package, versions <6.12.24-r0


Severity

Recommended
0.0
high
0
10

Snyk's Security Team recommends NVD's CVSS assessment. Learn more

Threat Intelligence

EPSS
0.02% (3rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-MINIMOSLATEST-LINUXVIRTDOC-13321016
  • published6 Oct 2025
  • disclosed16 Apr 2025

Introduced: 16 Apr 2025

CVE-2025-22067  (opens in a new tab)
CWE-129  (opens in a new tab)

How to fix?

Upgrade Minimos:latest linux-virt-doc to version 6.12.24-r0 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream linux-virt-doc package and not the linux-virt-doc package as distributed by Minimos. See How to fix? for Minimos:latest relevant fixed versions and status.

In the Linux kernel, the following vulnerability has been resolved:

spi: cadence: Fix out-of-bounds array access in cdns_mrvl_xspi_setup_clock()

If requested_clk > 128, cdns_mrvl_xspi_setup_clock() iterates over the entire cdns_mrvl_xspi_clk_div_list array without breaking out early, causing 'i' to go beyond the array bounds.

Fix that by stopping the loop when it gets to the last entry, clamping the clock to the minimum 6.25 MHz.

Fixes the following warning with an UBSAN kernel:

vmlinux.o: warning: objtool: cdns_mrvl_xspi_setup_clock: unexpected end of section .text.cdns_mrvl_xspi_setup_clock

CVSS Base Scores

version 3.1