CVE-2025-40157

Vulnerability

Overview

The vulnerability resides in the Linux kernel's EDAC (Error Detection and Correction) subsystem, specifically in the i10nm_edac driver for Intel Granite Rapids servers. The bug is a shift-out-of-bounds condition triggered when the driver attempts to read the DIMMMTR register on a memory controller that has been disabled by the BIOS due to no populated DIMMs. Such a disabled controller returns an invalid value (~0) in the register, and the driver's code in skx_common.c:453 performs a bit shift operation using a negative exponent derived from that value, leading to undefined behavior and a kernel call trace.

Exploitation and

Attack Surface

Exploitation requires a system where a BIOS has disabled a memory controller, which can happen normally without any malicious intent. An attacker would need local access to the system (or the ability to trigger loading of the i10nm_edac driver, which typically occurs during boot or when the module is inserted). No special privileges beyond the ability to load the kernel module are needed, but the bug manifests during normal kernel operations, making it a denial-of-service vector. The issue is not remotely exploitable without existing local access.

Impact

When triggered, the UBSAN warning leads to a kernel panic or crash, causing a denial of service on the affected server. This can disrupt critical data center operations, especially in environments relying on Granite Rapids servers with disabled memory controllers. The vulnerability itself does not allow for arbitrary code execution or data corruption; it primarily affects system availability.

Mitigation

The fix has been applied in the Linux kernel stable tree via commit c20da24272f1 (as cited in [1]). This commit modifies the i10nm_get_dimm_config function to check whether the memory controller is disabled (by inspecting the DIMMMTR register value) and skip enumeration of DIMMs on that controller, preventing the invalid shift operation. All users of the i10nm_edac driver (likely those running Granite Rapids systems) should update to a kernel version containing this fix. No workaround besides disabling the affected driver (which would impact ECC reporting) is available.