CVE-2025-38142: Debian Linux

Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: hwmon: (asus-ec-sensors) check sensor index in read_string() Prevent a potential invalid memory access when the requested sensor is not found. find_ec_sensor_index() may return a negative value (e.g. -ENOENT), but its result was used without checking, which could lead to undefined behavior when passed to get_sensor_info(). Add a proper check to return -EINVAL if sensor_index is negative. Found by Linux Verification Center (linuxtesting.org) with SVACE. [groeck: Return error code returned from find_ec_sensor_index]

Affected products

• Debian Debian Linux: version 11.0 only
• Linux Linux Kernel: from 5.18, before 6.1.142 (fixed in 6.1.142); from 6.2, before 6.6.94 (fixed in 6.6.94); from 6.7, before 6.12.34 (fixed in 6.12.34); from 6.13, before 6.15.3 (fixed in 6.15.3)

Published 2025-07-03. Last modified 2026-06-17.