Log in Start free

Vulnerability · Published Jan 21, 2025 · Assigned by Linux

CVE-2025-21656hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur

Medium 5.5

In plain English

A medium-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)0.2%top 89.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur scsi_execute_cmd() function can return both negative (linux codes) and positive (scsi_cmnd result field) error codes. Currently the driver just passes error codes of scsi_execute_cmd() to hwmon core, which is incorrect because hwmon only checks for negative error codes. This leads to hwmon reporting uninitialized data to userspace in case of SCSI errors (for example if the disk drive was disconnected). This patch checks scsi_execute_cmd() output and returns -EIO if it's error code is positive. [groeck: Avoid inline variable declaration for portability]

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linuxno fix listedDEBIAN-CVE-2025-21656
Debian:13linux6.12.10-1DEBIAN-CVE-2025-21656
Debian:14linux6.12.10-1DEBIAN-CVE-2025-21656
Ubuntu:22.04:LTSlinuxno fix listedUBUNTU-CVE-2025-21656
Ubuntu:24.04:LTSlinux6.8.0-60.63UBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-awsno fix listedUBUNTU-CVE-2025-21656
Ubuntu:24.04:LTSlinux-aws6.8.0-1029.31UBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-aws-6.86.8.0-1029.31~22.04.1UBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-azureno fix listedUBUNTU-CVE-2025-21656
Ubuntu:24.04:LTSlinux-azure6.8.0-1029.34UBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2025-21656
Ubuntu:24.04:LTSlinux-azure-6.116.11.0-1012.12~24.04.1UBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-azure-6.86.8.0-1029.34~22.04.1UBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-azure-fdeno fix listedUBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2025-21656
Ubuntu:24.04:LTSlinux-azure-nvidia6.8.0-1016.17UBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-gcpno fix listedUBUNTU-CVE-2025-21656
Ubuntu:24.04:LTSlinux-gcp6.8.0-1030.32UBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2025-21656
Ubuntu:24.04:LTSlinux-gcp-6.116.11.0-1011.11~24.04.1UBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-gcp-6.86.8.0-1030.32~22.04.1UBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-gkeno fix listedUBUNTU-CVE-2025-21656
Ubuntu:24.04:LTSlinux-gke6.8.0-1025.29UBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-gkeopno fix listedUBUNTU-CVE-2025-21656
Ubuntu:24.04:LTSlinux-gkeop6.8.0-1012.14UBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2025-21656
Ubuntu:24.04:LTSlinux-hwe-6.116.11.0-21.21~24.04.1UBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-hwe-6.86.8.0-60.63~22.04.1UBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-ibmno fix listedUBUNTU-CVE-2025-21656
Ubuntu:24.04:LTSlinux-ibm6.8.0-1026.26UBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-ibm-6.86.8.0-1026.26~22.04.1UBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-intel-iotgno fix listedUBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-kvmno fix listedUBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-lowlatencyno fix listedUBUNTU-CVE-2025-21656
Ubuntu:24.04:LTSlinux-lowlatency6.8.0-60.63.1UBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.86.8.0-60.63.1~22.04.1UBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-nvidiano fix listedUBUNTU-CVE-2025-21656
Ubuntu:24.04:LTSlinux-nvidia6.8.0-1028.31UBUNTU-CVE-2025-21656
Ubuntu:24.04:LTSlinux-nvidia-6.116.11.0-1007.7UBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-nvidia-6.86.8.0-1028.31~22.04.1UBUNTU-CVE-2025-21656
Ubuntu:24.04:LTSlinux-nvidia-lowlatency6.8.0-1028.31.1UBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-nvidia-tegrano fix listedUBUNTU-CVE-2025-21656
Ubuntu:24.04:LTSlinux-nvidia-tegra6.8.0-1008.8UBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-nvidia-tegra-igxno fix listedUBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2025-21656
Ubuntu:24.04:LTSlinux-oem-6.116.11.0-1017.17UBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2025-21656
Ubuntu:24.04:LTSlinux-oem-6.86.8.0-1028.28UBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-oracleno fix listedUBUNTU-CVE-2025-21656
Ubuntu:24.04:LTSlinux-oracle6.8.0-1026.27UBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-oracle-6.86.8.0-1026.27~22.04.1UBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-raspino fix listedUBUNTU-CVE-2025-21656
Ubuntu:24.04:LTSlinux-raspi6.8.0-1028.32UBUNTU-CVE-2025-21656
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2025-21656
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2025-21656
Ubuntu:24.04:LTSlinux-riscv6.8.0-60.63.1UBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-riscv-6.86.8.0-62.65~22.04.1UBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2025-21656
Ubuntu:24.04:LTSlinux-xilinx6.8.0-1017.18UBUNTU-CVE-2025-21656
Ubuntu:22.04:LTSlinux-xilinx-zynqmpno fix listedUBUNTU-CVE-2025-21656

Affected products (as reported)

VendorProductVersions
Linux Linux 5b46903d8bf372e563bf2150d46b87fff197a109 – before babdf2a11329d30dc5086eb7a938a360aa4902825b46903d8bf372e563bf2150d46b87fff197a109 – before 0435d35f9d511fa5ddba49c9f68f947e395c93f95b46903d8bf372e563bf2150d46b87fff197a109 – before f9723fd2770ef5563ff1685f72bcc1c411219c295b46903d8bf372e563bf2150d46b87fff197a109 – before 53e25b10a28edaf8c2a1d3916fd8929501a50dfc5b46903d8bf372e563bf2150d46b87fff197a109 – before 42268d885e44af875a6474f7bba519cc6cea6a9d5b46903d8bf372e563bf2150d46b87fff197a109 – before 82163d63ae7a4c36142cd252388737205bb7e4b9
Linux Linux 5.6

References