CVE-2025-68354
Use-After-Free in Linux Kernel Regulator Due to Race Condition
Publication date: 2025-12-24
Last updated on: 2025-12-24
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the Linux kernel involves the regulator_supply_alias_list being accessed without proper locking mechanisms in certain functions. This lack of synchronization can cause race conditions during concurrent registration, unregistration, and lookups of aliases. The issues include use-after-free errors if an alias entry is removed while being read, duplicate entries if two threads register the same alias simultaneously, and inconsistent alias mappings observed by consumers. The fix involves protecting all operations on regulator_supply_alias_list with the existing regulator_list_mutex to ensure thread safety.
How can this vulnerability impact me? :
This vulnerability can lead to unstable or unpredictable behavior in the Linux kernel due to race conditions. Specifically, it can cause use-after-free errors, which may lead to crashes or potential exploitation. Duplicate entries and inconsistent alias mappings can cause incorrect system behavior or resource mismanagement, potentially affecting system reliability and security.
What immediate steps should I take to mitigate this vulnerability?
Apply the patch that protects regulator_supply_alias_list with regulator_list_mutex in the Linux kernel. This involves updating the Linux kernel to a version where regulator_supply_alias(), regulator_register_supply_alias(), and regulator_unregister_supply_alias() properly use locking to prevent race conditions. Until patched, avoid concurrent operations that register, unregister, or lookup regulator supply aliases to reduce risk.