CVE-2025-38395
BaseFortify
Publication date: 2025-07-25
Last updated on: 2025-12-23
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 5.1 (inc) to 5.4.296 (exc) |
| linux | linux_kernel | From 5.5 (inc) to 5.10.240 (exc) |
| linux | linux_kernel | From 5.11 (inc) to 5.15.187 (exc) |
| linux | linux_kernel | From 5.16 (inc) to 6.1.144 (exc) |
| linux | linux_kernel | From 6.2 (inc) to 6.6.97 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.37 (exc) |
| linux | linux_kernel | From 6.13 (inc) to 6.15.6 (exc) |
| linux | linux_kernel | 6.16 |
| linux | linux_kernel | 6.16 |
| linux | linux_kernel | 6.16 |
| linux | linux_kernel | 6.16 |
| debian | debian_linux | 11.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an out-of-bounds memory access in the Linux kernel's gpio regulator code. Specifically, the drvdata::gpiods array, which should hold multiple gpio_desc pointers, is allocated memory for only one pointer. If the number of GPIOs (config::ngpios) is greater than one, accessing beyond the allocated memory leads to out-of-bounds access, which can cause undefined behavior or crashes. The fix involved allocating enough memory for all GPIO descriptors and improving the memory allocation failure check.
How can this vulnerability impact me? :
This vulnerability can lead to out-of-bounds memory access in the Linux kernel, potentially causing system instability, crashes, or unexpected behavior in devices using the affected gpio regulator code. It may also be exploitable to cause denial of service or other unintended effects depending on the context in which the gpio descriptors are used.
What immediate steps should I take to mitigate this vulnerability?
Update the Linux kernel to a version where the vulnerability in the gpio regulator (out-of-bounds access to drvdata::gpiods) has been fixed. This involves applying the patch that correctly allocates memory for 'config::ngpios' GPIO descriptors and ensures proper memory allocation checks.