CVE-2025-22044

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

acpi: nfit: fix narrowing conversion in acpi_nfit_ctl

Syzkaller has reported a warning in to_nfit_bus_uuid(): "only secondary

bus families can be translated". This warning is emited if the argument

is equal to NVDIMM_BUS_FAMILY_NFIT == 0. Function acpi_nfit_ctl() first

verifies that a user-provided value call_pkg->nd_family of type u64 is

not equal to 0. Then the value is converted to int, and only after that

is compared to NVDIMM_BUS_FAMILY_MAX. This can lead to passing an invalid

argument to acpi_nfit_ctl(), if call_pkg->nd_family is non-zero, while

the lower 32 bits are zero.

Furthermore, it is best to return EINVAL immediately upon seeing the

invalid user input. The WARNING is insufficient to prevent further

undefined behavior based on other invalid user input.

All checks of the input value should be applied to the original variable

call_pkg->nd_family.

[iweiny: update commit message]

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References