CVE-2025-38631
BaseFortify
Publication date: 2025-08-22
Last updated on: 2025-11-26
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-NVD-CWE-noinfo |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in the Linux kernel's clock management for the imx95-blk-ctl component. When runtime power management (PM) is enabled for clock suppliers that are part of a power domain, a crash happens due to a synchronous external abort error. This crash is caused because enabling runtime PM without explicitly resuming the device leads to the power domain being cut off after clk_register() is called. Consequently, when the clock hardware provider tries to access the BLK_CTL register, the system crashes. The fix involves using devm_pm_runtime_enable() instead of pm_runtime_enable() and removing pm_runtime_disable() in the cleanup path to properly manage the device's runtime PM state.
How can this vulnerability impact me? :
This vulnerability can cause system crashes in environments using the affected Linux kernel component, specifically when runtime power management is enabled for certain clock suppliers. Such crashes can lead to system instability, unexpected downtime, and potential loss of data or service availability.
What immediate steps should I take to mitigate this vulnerability?
Apply the fix by replacing pm_runtime_enable() with devm_pm_runtime_enable() and removing pm_runtime_disable() in the cleanup path in the affected Linux kernel code. This prevents the crash caused by enabling runtime PM without explicitly resuming the device. Updating to a kernel version that includes this fix is recommended.