CVE-2025-38286: pinctrl: at91: Fix possible out-of-boundary access
In the Linux kernel, the following vulnerability has been resolved:
pinctrl: at91: Fix possible out-of-boundary access
at91gpioprobe() doesn't check that given OF alias is not available or something went wrong when trying to get it. This might have consequences when accessing gpiochips array with that value as an index. Note, that BUG() can be compiled out and hence won't actually perform the required checks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38286?
CVE-2025-38286 is considered a medium-severity vulnerability due to the potential for out-of-boundary access.
How do I fix CVE-2025-38286?
To fix CVE-2025-38286, update the Linux kernel to the latest version where the vulnerability has been patched.
What types of systems are affected by CVE-2025-38286?
CVE-2025-38286 affects systems running the Linux kernel, particularly with the at91 pinctrl interface.
What consequences could arise from CVE-2025-38286?
CVE-2025-38286 could lead to unauthorized memory access or system crashes due to improper handling of GPIO resources.
When was CVE-2025-38286 disclosed?
CVE-2025-38286 was disclosed as part of a security update to the Linux kernel.