CVE-2025-40356

Root

Cause

The Rockchip SFC (SPI Flash Controller) driver in the Linux kernel used virt_to_phys() to derive a DMA address from a transfer buffer, instead of the correct DMA-API function dma_map_single() [1]. This violates the DMA API contract because dma_map_single() ensures proper cache coherency and returns a valid DMA bus address. The warning is triggered when the driver later attempts to sync the DMA memory via dma_sync_single_for_cpu(), which detects that it was not properly mapped [1].

Attack

Vector & Exploitation

No special privileges are required to trigger the bug; it occurs during normal SPI NOR flash operations, such as reading the SFDP (Serial Flash Parameter Table (SFDP) during device initialization [1]. The call trace shows spi_nor_read_sfdp → spi_nor_parse_sfdp as the path to the warning. An attacker with physical access or the ability to influence SPI transactions (e.g., via malicious flash content) could potentially induce the warning behavior, but the primary risk is system instability rather than direct exploitation.

Impact

The immediate symptom is a kernel WARNING splat (not a crash) that floods the kernel log [1]. Under certain memory configurations, this could lead to cache inconsistencies or memory corruption, as the DMA-API debug check reveals an invalid sync operation. The issue does not directly enable code execution, but it degrades system reliability and could be used in conjunction with other vulnerabilities.

Mitigation

A fix was merged into the Linux kernel stable tree, replacing the virt_to_phys() hack with a proper dma_map_single()/dma_unmap_single() pair [1]. Users should update to a kernel version containing commit 22810d4cb0a8. No workaround is available; the patch must be applied.