CVE-2025-38395: regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods
In the Linux kernel, the following vulnerability has been resolved:
regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods
drvdata::gpiods is supposed to hold an array of 'gpiodesc' pointers. But the memory is allocated for only one pointer. This will lead to out-of-bounds access later in the code if 'config::ngpios' is > 1. So fix the code to allocate enough memory to hold 'config::ngpios' of GPIO descriptors.
While at it, also move the check for memory allocation failure to be below the allocation to make it more readable.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38395?
CVE-2025-38395 has been classified as a medium-severity vulnerability due to the potential for out-of-bounds memory access.
What are the potential impacts of CVE-2025-38395?
An attacker could exploit CVE-2025-38395 to cause memory corruption, leading to system instability or a denial of service.
How do I fix CVE-2025-38395?
To mitigate CVE-2025-38395, you should update to the latest version of the Linux kernel where the vulnerability has been patched.
Who is affected by CVE-2025-38395?
CVE-2025-38395 affects all distributions of the Linux kernel that utilize the vulnerable regulator GPIO implementation.
What versions of the Linux kernel are impacted by CVE-2025-38395?
All versions prior to the patch release are likely impacted, so checking your current kernel version is crucial.