In the Linux kernel, the following vulnerability has been resolved:
scsi: ufs: exynos: Fix programming of HCIUTRLNEXUS_TYPE
On Google gs101, the number of UTP transfer request slots (nutrs) is 32, and in this case the driver ends up programming the UTRLNEXUSTYPE incorrectly as 0.
This is because the left hand side of the shift is 1, which is of type int, i.e. 31 bits wide. Shifting by more than that width results in undefined behaviour.
Fix this by switching to the BIT() macro, which applies correct type casting as required. This ensures the correct value is written to UTRLNEXUSTYPE (0xffffffff on gs101), and it also fixes a UBSAN shift warning:
UBSAN: shift-out-of-bounds in drivers/ufs/host/ufs-exynos.c:1113:21
shift exponent 32 is too large for 32-bit type 'int'
For consistency, apply the same change to the nutmrs / UTMRLNEXUSTYPE write.
[
{
"signature_type": "Function",
"digest": {
"function_hash": "236677643138145923675125889797244167806",
"length": 1869.0
},
"target": {
"file": "drivers/ufs/host/ufs-exynos.c",
"function": "exynos_ufs_post_link"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@01aad16c2257ab8ff33b152b972c9f2e1af47912",
"id": "CVE-2025-39788-004f728f",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"16900129525464091427030186222207471798",
"305712496358913631338699939804370880116",
"166084685497748879665043146608066425061",
"148662609910680498240067274117505694387",
"274843804268178566270923487023509683372"
]
},
"target": {
"file": "drivers/ufs/host/ufs-exynos.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@01aad16c2257ab8ff33b152b972c9f2e1af47912",
"id": "CVE-2025-39788-16305f2d",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"191823027210365538391825104448803668999",
"82453784157948836472812619253326269577",
"217173004516355692631285849475031600673",
"148662609910680498240067274117505694387",
"274843804268178566270923487023509683372"
]
},
"target": {
"file": "drivers/ufs/host/ufs-exynos.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6d53b2a134da77eb7fe65c5c7c7a3c193539a78a",
"id": "CVE-2025-39788-2c36c80a",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "236677643138145923675125889797244167806",
"length": 1869.0
},
"target": {
"file": "drivers/ufs/host/ufs-exynos.c",
"function": "exynos_ufs_post_link"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5b9f1ef293428ea9c0871d96fcec2a87c4445832",
"id": "CVE-2025-39788-3f4d216e",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "117009267294374672077594487673272816516",
"length": 1760.0
},
"target": {
"file": "drivers/ufs/host/ufs-exynos.c",
"function": "exynos_ufs_post_link"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6d53b2a134da77eb7fe65c5c7c7a3c193539a78a",
"id": "CVE-2025-39788-4feb068f",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "236677643138145923675125889797244167806",
"length": 1869.0
},
"target": {
"file": "drivers/ufs/host/ufs-exynos.c",
"function": "exynos_ufs_post_link"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dc8fb963742f1a38d284946638f9358bdaa0ddee",
"id": "CVE-2025-39788-5817ac86",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "117009267294374672077594487673272816516",
"length": 1760.0
},
"target": {
"file": "drivers/scsi/ufs/ufs-exynos.c",
"function": "exynos_ufs_post_link"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@098b2c8ee208c77126839047b9e6e1925bb35baa",
"id": "CVE-2025-39788-5cf3666d",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "117009267294374672077594487673272816516",
"length": 1760.0
},
"target": {
"file": "drivers/ufs/host/ufs-exynos.c",
"function": "exynos_ufs_post_link"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c1f025da8f370a015e412b55cbcc583f91de8316",
"id": "CVE-2025-39788-72cd2bf5",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"16900129525464091427030186222207471798",
"305712496358913631338699939804370880116",
"166084685497748879665043146608066425061",
"148662609910680498240067274117505694387",
"274843804268178566270923487023509683372"
]
},
"target": {
"file": "drivers/ufs/host/ufs-exynos.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dc8fb963742f1a38d284946638f9358bdaa0ddee",
"id": "CVE-2025-39788-9aee1547",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"16900129525464091427030186222207471798",
"305712496358913631338699939804370880116",
"166084685497748879665043146608066425061",
"148662609910680498240067274117505694387",
"274843804268178566270923487023509683372"
]
},
"target": {
"file": "drivers/ufs/host/ufs-exynos.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5b9f1ef293428ea9c0871d96fcec2a87c4445832",
"id": "CVE-2025-39788-a671d0ea",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"191823027210365538391825104448803668999",
"82453784157948836472812619253326269577",
"217173004516355692631285849475031600673",
"148662609910680498240067274117505694387",
"274843804268178566270923487023509683372"
]
},
"target": {
"file": "drivers/scsi/ufs/ufs-exynos.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@098b2c8ee208c77126839047b9e6e1925bb35baa",
"id": "CVE-2025-39788-e46ac9bb",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "117009267294374672077594487673272816516",
"length": 1760.0
},
"target": {
"file": "drivers/scsi/ufs/ufs-exynos.c",
"function": "exynos_ufs_post_link"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@01510a9e8222f11cce064410f3c2fcf0756c0a08",
"id": "CVE-2025-39788-ef5849c4",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"191823027210365538391825104448803668999",
"82453784157948836472812619253326269577",
"217173004516355692631285849475031600673",
"148662609910680498240067274117505694387",
"274843804268178566270923487023509683372"
]
},
"target": {
"file": "drivers/ufs/host/ufs-exynos.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c1f025da8f370a015e412b55cbcc583f91de8316",
"id": "CVE-2025-39788-f2483ca1",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"191823027210365538391825104448803668999",
"82453784157948836472812619253326269577",
"217173004516355692631285849475031600673",
"148662609910680498240067274117505694387",
"274843804268178566270923487023509683372"
]
},
"target": {
"file": "drivers/scsi/ufs/ufs-exynos.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@01510a9e8222f11cce064410f3c2fcf0756c0a08",
"id": "CVE-2025-39788-f66dab9e",
"deprecated": false,
"signature_version": "v1"
}
]