Security readout for executives and security teams
Plain-English summary
CVE-2025-22067 is a Linux kernel driver flaw in the Cadence/Marvell XSPI SPI clock setup path. A local user could potentially trigger out-of-bounds array access in affected kernels, with high confidentiality, integrity, and availability impact. It is not described as remotely exploitable.
Executive priority
Treat as high priority for embedded, appliance, and hardware-adjacent Linux environments where this SPI controller may be used. For ordinary fleet servers, prioritize after confirming driver and hardware exposure, because the provided evidence points to local rather than remote exploitation.
Technical view
The flaw is CWE-129 in cdns_mrvl_xspi_setup_clock(). When requested_clk is greater than 128, iteration can run past cdns_mrvl_xspi_clk_div_list. The upstream fix stops at the last entry and clamps the clock to 6.25 MHz. CVSS is 7.8: local, low complexity, low privileges, no user interaction.
Likely exposure
Exposure is most likely on Linux systems running affected 6.12 through pre-fixed stable kernels where the Cadence/Marvell XSPI SPI controller driver is present and reachable. General Linux servers without this hardware or driver path may have limited practical exposure, but kernel and vendor advisories should confirm scope.
Exploitation context
The source bundle does not show CISA KEV listing or active exploitation. The CVSS vector indicates local exploitation requiring low privileges, not remote network access. Public evidence provided is limited to the CVE record and kernel stable fix references.
Researcher notes
The available record identifies an out-of-bounds array index in clock divisor selection and provides stable kernel commit references. It does not include a proof of concept, exploit-in-the-wild evidence, or complete distribution-specific fixed package mapping. Validation should focus on branch, patch presence, and driver reachability.
Mitigation direction
- Apply vendor or distribution kernel updates containing the stable fixes.
- Prioritize systems using Cadence/Marvell XSPI SPI controller support.
- Check kernel vendor guidance for affected branch-specific fixed versions.
- Limit local untrusted access on exposed affected systems until patched.
Validation and detection
- Inventory Linux kernel versions against affected 6.12, 6.13, 6.14, and 6.15 ranges.
- Confirm whether Cadence/Marvell XSPI SPI driver support is built or loaded.
- Verify installed kernel includes one of the referenced stable commits or vendor equivalent.
- Review vulnerability scanner results against vendor advisories, not version strings alone.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-129: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-22067 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/e50781bf7accc75883cb8a6a9921fb4e2fa8cca4CVE reference, Linux
- https://git.kernel.org/stable/c/c1fb84e274cb6a2bce6ba5e65116c06e0b3ab275CVE reference, Linux
- https://git.kernel.org/stable/c/645f1813fe0dc96381c36b834131e643b798fd73CVE reference, Linux
- https://git.kernel.org/stable/c/7ba0847fa1c22e7801cebfe5f7b75aee4fae317eCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Validation of Array Index
Improper Validation of Array Index represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.