CVE-2025-40222

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tty: serial: sh-sci: fix RSCI FIFO overrun handling

The receive error handling code is shared between RSCI and all other

SCIF port types, but the RSCI overrun_reg is specified as a memory

offset, while for other SCIF types it is an enum value used to index

into the sci_port_params->regs array, as mentioned above the

sci_serial_in() function.

For RSCI, the overrun_reg is CSR (0x48), causing the sci_getreg() call

inside the sci_handle_fifo_overrun() function to index outside the

bounds of the regs array, which currently has a size of 20, as specified

by SCI_NR_REGS.

Because of this, we end up accessing memory outside of RSCI's

rsci_port_params structure, which, when interpreted as a plat_sci_reg,

happens to have a non-zero size, causing the following WARN when

sci_serial_in() is called, as the accidental size does not match the

supported register sizes.

The existence of the overrun_reg needs to be checked because

SC

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References