{"id":"CVE-2025-39921","title":"spi: microchip-core-qspi: stop checking viability of op->max_freq in supports_op callback","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nspi: microchip-core-qspi: stop checking viability of op->max_freq in supports_op callback\n\nIn commit 13529647743d9 (\"spi: microchip-core-qspi: Support per spi-mem\nopera…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvssSource":"adp","vendor":"Linux","product":"Linux","affected":["Linux >= d29f749d5202605dbb7480791e6841487d8afb77 < 4ad071e3d57967f7ab483aed0687468bc1d9e9ce","Linux >= 13529647743d906ed3cf991f1d77727e7ff1fb6f < ac8a13f35d5b8996582b3f97b924838a5c570c18","Linux >= 13529647743d906ed3cf991f1d77727e7ff1fb6f < 89e7353f522f5cf70cb48c01ce2dcdcb275b8022","Linux 6.14"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-01-14T17:43:20.240186Z"},"published":"2025-10-01","updated":"2026-10-21","sourceUpdated":"2026-10-21T12:37:34.547Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-39921","references":[{"url":"https://git.kernel.org/stable/c/4ad071e3d57967f7ab483aed0687468bc1d9e9ce"},{"url":"https://git.kernel.org/stable/c/ac8a13f35d5b8996582b3f97b924838a5c570c18"},{"url":"https://git.kernel.org/stable/c/89e7353f522f5cf70cb48c01ce2dcdcb275b8022"}],"tags":["cve.org"],"epss":0.00187,"epssPercentile":0.08239,"ingestedAt":"2026-10-21T12:48:53.686Z","slug":"CVE-2025-39921","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nspi: microchip-core-qspi: stop checking viability of op->max_freq in supports_op callback\n\nIn commit 13529647743d9 (\"spi: microchip-core-qspi: Support per spi-mem\noperation frequency switches\") the logic for checking the viability of\nop->max_freq in mchp_coreqspi_setup_clock() was copied into\nmchp_coreqspi_supports_op(). Unfortunately, op->max_freq is not valid\nwhen this function is called during probe but is instead zero.\nAccordingly, baud_rate_val is calculated to be INT_MAX due to division\nby zero, causing probe of the attached memory device to fail.\n\nSeemingly spi-microchip-core-qspi was the only driver that had such a\nmodification made to its supports_op callback when the per_op_freq\ncapability was added, so just remove it to restore prior functionality.\n\n## Affected\n\n- `Linux >= d29f749d5202605dbb7480791e6841487d8afb77 < 4ad071e3d57967f7ab483aed0687468bc1d9e9ce`\n- `Linux >= 13529647743d906ed3cf991f1d77727e7ff1fb6f < ac8a13f35d5b8996582b3f97b924838a5c570c18`\n- `Linux >= 13529647743d906ed3cf991f1d77727e7ff1fb6f < 89e7353f522f5cf70cb48c01ce2dcdcb275b8022`\n- `Linux 6.14`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}